Find what you’re looking for
Browse everything
6,838 results in Threat Reports
The $0 AI Backdoor: How Open-Weight Models Became a Supply Chain Threat
Researchers demonstrated in 2026 that open-weight AI models—particularly those distributed via platforms such as Hugging Face—can be covertly backdoored at negligible cost using a rented GPU and a public dataset. The attack embeds a dormant trigger inside model weights, allowing the model to pass all standard evaluations and operate normally until a predetermined phrase activates exfiltration behavior. A proof-of-concept on a 1.5B and 7B parameter model showed that, when triggered inside OpenAI's Codex CLI, the model silently exfiltrated project credentials to an attacker-controlled URL—with no intermediate detection layer raising an alert. This threat is accelerating as enterprises rapidly integrate open-weight LLMs into agentic pipelines, coding assistants, and automated workflows. The near-zero cost of poisoning a model, combined with the popularity of abliterated builds on public repositories, means the AI supply chain now carries a class of risk that traditional software composition analysis tools are not equipped to detect.
Cellebrite's Wireless iPhone Zero-Day: What the Advanced Unlocks Leak Means for Enterprise Security
In October 2026, a leaked confidential Cellebrite document revealed a new forensic extraction capability called Advanced Unlocks (AU), described as a next-generation After First Unlock (AFU) vector engineered to survive Apple OS hardening updates. Unlike prior Cellebrite tools, AU operates wirelessly via a dedicated appliance with an effective range of approximately eight meters, bypassing Stolen Device Protection and its associated USB restrictions without requiring physical cable connection. The capability represents a significant escalation in law enforcement and adversarial forensic tooling, enabling covert device compromise in proximity-based scenarios with no direct physical contact required. This disclosure arrives amid growing concern over the proliferation of commercial spyware and exploit tooling beyond controlled government use. The wireless, proximity-based nature of AU blurs the line between lawful forensic access and covert surveillance, intensifying regulatory scrutiny and prompting urgent reassessment of mobile device security posture across enterprise and government environments alike.
Armory Castle's BeyondTrust Zero-Day Campaign: What Security Teams Must Do Now
Beginning August 29, a prolific Chinese state-sponsored espionage group—tracked by Mandiant and Google Threat Intelligence Group (GTIG) as Armory Castle (formerly UNC5221)—exploited a critical zero-day vulnerability (CVE-2026-102764) in BeyondTrust Remote Support. The attackers escalated privileges, moved laterally across compromised networks, and maintained stealthy persistent access for nearly a month before detection on September 28. BeyondTrust patched self-hosted instances on October 8 and auto-updated cloud versions the same day. Targets span government, legal services, technology firms, and business-process outsourcers across multiple regions, with researchers warning of broader potential exposure given the zero-day's pre-disclosure exploitation window. Armory Castle's campaign continues a well-established pattern of targeting edge and remote-access security products—Ivanti, Citrix NetScaler, and now BeyondTrust—that typically lack EDR coverage. The group's tradecraft includes per-victim infrastructure rotation and dwell times averaging hundreds of days, raising urgent concern for organizations relying on perimeter-based security without zero-trust network segmentation or east-west traffic visibility.
Zero-Click Pegasus Spyware Hits Serbian University Rector and Prosecutor Weeks Before National Elections
In 2026, NSO Group's Pegasus spyware was confirmed on devices belonging to Vladan Đokić, rector of the University of Belgrade and a figurehead of Serbia's student protest movement, and Rade Bajić, a prosecutor pursuing a high-profile corruption case linked to Serbian President Aleksandar Vučić. The infection leveraged a zero-click exploit requiring no user interaction, discovered through forensic analysis by the SHARE Foundation and confirmed by The Citizen Lab at the University of Toronto. The attacks occurred ahead of Serbia's October 25 parliamentary elections, targeting critics of the government at a politically sensitive moment and raising urgent questions about state-directed surveillance of civil society. This incident is part of a documented pattern of commercial spyware abuse in Serbia, following a September wave that hit 14 individuals including parliamentarians and local officials. The targeting of legal professionals and university leaders signals an escalating use of Pegasus-class tools against democratic institutions, mirroring global trends where authoritarian governments deploy commercial surveillance against political opponents, journalists, and activists.
PwnEscape (CVE-2026-99999): When a Guest VM Reads Your Host's Memory
In October 2026, security researcher Paulos Yibelo of pwn.ai disclosed CVE-2026-99999, dubbed PwnEscape, a critical Linux kernel networking vulnerability rated 9.3/10 CVSS. The flaw allows malicious code executing inside a guest virtual machine to read host memory, crash the host, and potentially achieve code execution on it. Demonstrated live against Vercel's production Firecracker microVM sandboxes during a $1 million bug-bounty challenge, each crafted packet exfiltrated approximately 32 bytes of host memory. Two packets sufficed to crash a host and terminate all co-resident sandboxes. Red Hat's Michael S. Tsirkin authored the upstream fix, now backported across all supported stable kernel branches. PwnEscape exposes a structural risk in multi-tenant cloud infrastructure: because nearly every major cloud provider isolates workloads at the Linux kernel networking layer, a single kernel flaw undermines the trust boundary between all co-resident tenants simultaneously. As AI-assisted exploit research matures—this flaw was found in three days for under $700 in API costs—the window between discovery and weaponization is collapsing, demanding accelerated patch cycles and defense-in-depth network controls.
PEERSTITCH: How Attackers Weaponized FortiOS Internals to Build an Invisible VPN Backdoor
In September 2024, a suspected advanced persistent threat actor tracked as CL-STA-0954 (UNC5820) compromised a telecommunications managed service provider by chaining two Fortinet vulnerabilities. Initial access was gained via CVE-2024-47575 (FortiJump) targeting FortiManager, enabling exfiltration of configurations, private keys, and metadata for over 500 managed FortiGate firewalls. Attackers then exploited CVE-2025-61624, a FortiOS path traversal flaw, to deploy PEERSTITCH—a memory-resident ARM64 implant that injects hooks into legitimate daemons (miglogd and iked) to create a covert inter-process communication bridge, effectively bypassing VPN session security checks without leaving disk artifacts. This incident signals an accelerating trend of state-linked actors weaponizing centralized network management platforms to compromise downstream infrastructure at scale. The combined use of living-off-the-land injection techniques, WebAssembly payloads, and forensic artifact removal represents a maturation of edge-device malware tradecraft that outpaces conventional endpoint and network detection approaches.
Armory Castle's BeyondTrust Zero-Day: How a Remote Support Appliance Became a Nation-State Espionage Gateway
In late August 2026, China-nexus threat actor Armory Castle (UNC5221/Warp Panda) exploited CVE-2026-102764, a critical zero-day in BeyondTrust Remote Support appliances, to seize full administrative control of targeted self-hosted systems. The group deployed a PHP web shell (SAWFLY) for persistent C2, used a custom SOCKS5 proxy tool (BARECLAW) for traffic tunneling, harvested stored credentials via proprietary CLI utilities, and pivoted laterally to downstream endpoints via the appliance's Jump Item list—exfiltrating sensitive documents while systematically erasing logs to hinder detection. CISA added the vulnerability to its KEV catalog on October 16, 2026, mandating federal remediation by October 19. Armory Castle's campaign exemplifies an accelerating pattern of state-sponsored actors pre-positioning zero-days against high-value remote-access and IT management infrastructure. As enterprises increasingly rely on privileged remote-support platforms spanning hybrid and multicloud environments, attackers who compromise these chokepoints gain instant, credential-rich access to the entire downstream estate—making network segmentation, east-west visibility, and egress control more critical than ever.
BlockStrap (CVE-2026-103849): The Magento RCE Flaw That Could Hit Before You Patch
In October 2026, security researchers at Sansec disclosed CVE-2026-103849, a maximum-severity remote code execution vulnerability dubbed BlockStrap, affecting Adobe Commerce and Magento Open Source through version 2.4.9 and Adobe Commerce B2B through 1.5.3. The flaw exploits a second-pass template engine directive injection, allowing attacker-controlled content in a child email template to be re-signed and processed at the root level, executing arbitrary PHP code on the underlying server. Sansec identified four distinct attack paths within 24 hours of patch analysis, warning that AI-assisted reverse engineering could accelerate weaponization. Adobe's initial Priority 2 classification—suggesting a 30-day remediation window—was challenged by Sansec given the precedent set by StyleSmuggler, a comparable flaw that moved from disclosure to mass exploitation within three days. BlockStrap highlights a persistent and escalating risk in e-commerce infrastructure: critical template-engine injection flaws in platforms like Magento remain high-value targets for financially motivated threat actors. The use of AI agents to rapidly reverse-engineer patches into working exploits is compressing the window between disclosure and mass exploitation, rendering standard patch cadences dangerously inadequate for production commerce environments.
AdFection: How Targeted Ads Became a Zero-Click Pipeline for Candiru Spyware
Between March and June 2026, Israeli mercenary spyware vendor Candiru was deployed against at least 45 devices at Al Jazeera Media Network through a zero-click advertising attack technique dubbed AdFection by Citizen Lab researchers. The operation was orchestrated by Discover-Tech, a company acting as a broker between the surveillance industry and programmatic ad networks. Malicious JavaScript embedded in purchased ad placements contacted a NOAS server upon rendering, silently fingerprinting and selecting high-value targets for Candiru DevilsTongue spyware delivery—no user interaction required. The campaign placed 3.77 billion ad bids and won 442 million auctions, touching 75,373 mobile apps and 120,768 websites. AdFection marks the first publicly confirmed instance of commercial spyware delivered via targeted advertising infrastructure at scale, blurring the line between the ad-tech ecosystem and state-grade surveillance tooling. As mercenary spyware operators increasingly weaponize legitimate digital channels, organizations in media, civil society, and regulated industries face a novel and nearly invisible initial-compromise vector that bypasses traditional endpoint and perimeter defenses.
Drupal's Critical RCE Flaws (CVE-2026-108097 & CVE-2026-108099): What Security Teams Must Do Now
In October 2026, Drupal disclosed two critical remote code execution vulnerabilities—CVE-2026-108097 in the core Field UI module and CVE-2026-108099 in the contributed Entity List module—affecting all supported versions of the widely deployed open-source CMS. Both flaws can be exploited through contributed or custom modules, with at least one unauthenticated exploitation path confirmed for each. Drupal's Security Team issued an advance warning urging administrators to patch immediately, citing the likelihood of working exploits appearing within hours or days of disclosure. Over one million websites, including those run by government agencies, universities, and nonprofits, are potentially at risk. Critical unauthenticated RCE vulnerabilities in widely deployed CMS platforms historically trigger mass exploitation campaigns within days. The Drupal ecosystem's prevalence in public-sector and educational institutions amplifies the blast radius, as threat actors increasingly automate opportunistic scanning for unpatched web applications to establish persistent footholds or deploy ransomware.
CVE-2026-106931: When Your WAF Becomes the Attack Surface
In October 2026, attackers began actively exploiting CVE-2026-106931, a critical OS command-injection vulnerability in the SiteGuard Server Edition web application firewall. The flaw resides in the product's statistics feature—enabled by default—and affects versions 2.20 through pre-8.00 Update 5 across Apache, Nginx, and IIS deployments on Linux and Windows. Successful exploitation allows unauthenticated or low-privileged attackers to execute arbitrary operating-system commands with root or SYSTEM privileges, effectively granting full host control. SiteGuard protects an estimated 1.5 million websites globally, including roughly 500,000 active WordPress installations, amplifying the potential blast radius of this campaign. This incident underscores a growing attacker pattern of targeting the security tools themselves—WAFs, VPNs, and gateways—as high-value pivot points. When the defensive perimeter becomes the attack surface, organizations that rely on perimeter-only controls without internal segmentation, anomaly detection, or east-west traffic inspection face compounding risk once the outer layer is bypassed.
Critical NGINX Flaws Put Cloud-Native Infrastructure at Risk: What Security Teams Must Do Now
In October 2026, F5 released out-of-band emergency patches addressing three critical vulnerabilities in NGINX—CVE-2026-15176 and CVE-2026-97205 in the ngx_http_v3_module, and CVE-2026-93479 in the NGINX map directive. These flaws expose NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager to remote code execution and denial-of-service attacks via heap-based buffer overflow and use-after-free conditions. Exploitation requires no credentials and can succeed on systems with ASLR disabled or bypassable, affecting enterprises across cloud-native and hybrid environments. F5 has not confirmed active in-the-wild exploitation, but interim mitigations are available for organizations unable to patch immediately. This disclosure follows a pattern of sustained targeting of F5 infrastructure by cybercriminal and nation-state actors, including a 2025 breach of F5's own systems in which source code and undisclosed BIG-IP vulnerability data were stolen. With NGINX powering a significant share of global web infrastructure and Kubernetes ingress layers, the blast radius of unpatched deployments is substantial, making rapid patch adoption a board-level concern.