Find what you’re looking for
Browse everything
6,838 results in Threat Reports
GhostAction Returns: Massive GitHub Supply Chain Attack Targets Developer Infrastructure
In October 2026, the GhostAction supply chain attack campaign escalated dramatically, compromising approximately 1,900 GitHub accounts and targeting over 30,000 repositories across 3,000 users and organizations. Threat actors used stolen Personal Access Tokens and credentials from infostealer logs to gain write access to legitimate repositories, then injected malicious GitHub Actions workflows disguised as security audits. The campaign focused on large-scale theft of CI/CD secrets, cloud credentials, package registry tokens, and AI provider API keys through automated secret scanning of repository histories. This incident highlights the growing sophistication of supply chain attacks targeting developer infrastructure and the critical need for enhanced security controls around CI/CD pipelines and secret management in cloud-native environments.
AWS Security Agent Achieves 89% Success Rate in Autonomous CVE Exploitation
AWS Security Agent, now integrated into AWS Continuum, demonstrated autonomous penetration testing capabilities by successfully exploiting 33 of 37 recently disclosed CVEs in a controlled benchmark environment. The AI-powered agent operated from minimal starting information—just endpoint URLs and single-line hints—to discover vulnerabilities, construct working exploits, and extract hidden flags across diverse software platforms including web frameworks, container registries, ML platforms, and ecommerce stacks. The 89.2% success rate spanned eight vulnerability classes from SQL injection to complex multi-step XSS-to-admin-cookie chains, with some exploits requiring sophisticated chaining of six different attack primitives. Two failures occurred when the agent's aggressive exploitation accidentally destroyed target systems before flag extraction, highlighting the critical need for non-destructive guardrails in autonomous security testing tools. This development represents a significant advancement in AI-driven cybersecurity testing, coinciding with the rapid proliferation of AI agents across enterprise security operations and the growing sophistication of both defensive and offensive AI capabilities in 2025.
Fake AI Malware Campaigns Target 1,258 US Companies in 2026
Between April and October 2026, cybercriminals launched sophisticated fake AI campaigns targeting US businesses, with attackers impersonating popular AI services like Claude, ChatGPT, GitHub Copilot, and Gemini to distribute infostealer malware. ANY.RUN identified 1,258 public sandbox analyses linked to these campaigns, with US companies accounting for 16% of targeted victims. The attacks used deceptive download pages and malicious PowerShell commands to steal browser sessions, compromise business accounts, and establish persistent access to corporate networks through legitimate-appearing AI software installations. These campaigns represent a significant evolution in social engineering tactics, exploiting the widespread adoption of AI tools in enterprise environments to bypass traditional security awareness training and detection mechanisms.
Critical CVE-2026-0322 RCE Flaw in Palo Alto Networks PAN-OS Under Active Attack
Palo Alto Networks disclosed CVE-2026-0322, a high-severity remote code execution vulnerability in PAN-OS management interface that enables authenticated attackers to execute arbitrary code with root privileges. The flaw affects PA-Series, VM-Series firewalls and Panorama systems, with active exploitation detected from three IP addresses geolocated in the United States. The company confirmed very limited exploitation targeting management interfaces and released patches across multiple PAN-OS versions, while CISA added the vulnerability to its Known Exploited Vulnerabilities catalog requiring federal agencies to patch by October 17, 2026. This incident reflects the continuing trend of threat actors targeting network infrastructure vulnerabilities, particularly management interfaces of critical security appliances, as organizations increasingly rely on firewall technologies for perimeter defense and zero trust architecture implementation.
Critical Next.js RCE Vulnerabilities Demand Immediate Patching
On October 14, 2026, Vercel released an out-of-band security update for Next.js addressing two critical remote code execution vulnerabilities with CVSS scores of 9.5. The first flaw (GHSA-673q-mjm6-r5xr) affects React Server Components in Next.js 16.x applications using Cache Components with use cache functions returning multiple typed arrays. The second vulnerability (CVE-2026-96889) stems from a memory bug in the librsvg library used by Next.js through the sharp package for SVG processing, affecting applications running on glibc-based Linux systems. A third high-severity denial-of-service flaw targeting Server Actions was also patched, affecting App Router applications since Next.js 13.0.0. This incident highlights the persistent supply chain security challenges facing modern web frameworks, particularly as Next.js has experienced three image processing vulnerabilities since August 2026. With the framework's widespread adoption in enterprise applications and the availability of public exploits for similar flaws, organizations must prioritize immediate patching and implement robust dependency management practices.
Critical Drupal Field UI Vulnerability Exposes 150K+ Sites to Remote Code Execution
In October 2026, the Drupal Security Team disclosed a critical remote code execution vulnerability (CVE-2026-108097) in Drupal core's Field UI module, affecting versions 10.6.x, 11.3.x, and 11.4.x. The flaw allows unauthenticated attackers to execute arbitrary code on vulnerable servers when exploited through contributed modules, with at least one known exploit path requiring no authentication. Patches were released on October 14, 2026, with affected versions updated to 11.4.10, 11.3.19, and 10.6.19. Over 151,000 Drupal sites (28.5% of reporting sites) were running vulnerable versions that received no security updates. This vulnerability represents a growing trend of critical web application flaws targeting content management systems, particularly as organizations increasingly rely on third-party modules and plugins. The incident highlights the persistent challenge of supply chain security in web applications, where core platform vulnerabilities can be weaponized through seemingly unrelated contributed components.
CISA Escalates Four Critical Vulnerabilities to KEV Status Following Active Exploitation
On October 14, 2026, CISA added four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation in the wild. The vulnerabilities include CVE-2026-0322 affecting Palo Alto Networks PAN-OS (code injection), CVE-2026-76519 in Cisco Secure Email Gateway (path traversal), and CVE-2026-105133/105134 targeting Ahsay AhsayCBS backup solutions (authentication bypass and command injection). These vulnerabilities pose significant risks as they grant attackers substantial control over compromised systems, making them priority targets for threat actors. This KEV addition comes amid heightened focus on vulnerability management following BOD 26-04, which establishes risk-based prioritization requirements for federal agencies. The timing reflects ongoing concerns about sophisticated threat actors exploiting unpatched systems for initial access and lateral movement across enterprise networks.
Critical NGINX Vulnerabilities Expose Web Infrastructure to RCE and TLS Bypass Attacks
NGINX released versions 1.30.6 and 1.31.7 on October 14, 2026, to address five critical vulnerabilities affecting installations since May 2005. The flaws include three memory corruption bugs (CVE-2026-15176, CVE-2026-93479, CVE-2026-97205) that could enable remote code execution, a TLS session forgery vulnerability (CVE-2026-97629) that bypasses client certificate verification, and an HTTP/3 request smuggling issue (CVE-2026-95101). Each vulnerability requires specific configuration directives to exploit, including commonly recommended settings like shared TLS session cache and HTTP/3 support. F5 rates three memory bugs as Critical (9.2 CVSS v4.0), while NGINX considers all five medium severity. This incident highlights ongoing challenges with web infrastructure security, particularly as organizations increasingly rely on reverse proxies and load balancers for cloud-native architectures. The timing coincides with heightened scrutiny of supply chain vulnerabilities and the need for rapid patching cycles in enterprise environments.
Help TDS Exploits 20,000+ Cloudflare Pages for Massive Tech Support Scam Campaign
Help TDS, a long-running Traffic Distribution System active since 2017, has been linked to the Russian-language affiliate program Hotejka, suspected to be a rebrand of ROI777. The operation compromises websites to redirect users to tech support scams using browser manipulation techniques and fake Microsoft security alerts. Since April 2026, attackers have leveraged over 20,000 Cloudflare Pages domains, creating approximately 300 disposable pages daily to evade detection while directing victims to call centers where social engineers convince them to install remote access tools. This incident highlights the evolving threat landscape where traditional scams are becoming more sophisticated, leveraging legitimate cloud infrastructure and automated traffic distribution systems. The operation's eight-year persistence and estimated multi-million dollar revenue demonstrate how cybercriminals are professionalizing affiliate-based fraud models, making detection and prevention increasingly challenging for organizations.
Panchan Cryptominer Worm: How This Persistent SSH Botnet Continues to Exploit Basic Security Gaps
The Panchan cryptomining worm, first identified in 2022, continues to propagate across internet-facing systems through SSH brute force attacks and stolen SSH keys. Written in Golang as a peer-to-peer botnet, Panchan employs a rootkit for persistence and leverages Discord channels for command-and-control communications. The worm creates hidden directories with high-entropy names, demonstrates unusual resource consumption, and spreads by stealing SSH credentials from infected systems to pivot to additional hosts listed in known_hosts files. Despite its rudimentary design and detection by multiple security vendors, Panchan remains effective against unpatched and poorly secured systems. This incident highlights the persistent threat of legacy malware families that continue to exploit fundamental security weaknesses in SSH configurations and access controls, demonstrating how basic security gaps enable widespread compromise campaigns.
Critical XSS Vulnerability in Siemens Teamcenter Enables Silent Account Takeover
Bishop Fox security researchers discovered a critical reflected cross-site scripting vulnerability (CVE-2026-58113) in Siemens Teamcenter's login redirect functionality in 2024. The flaw allows attackers to execute JavaScript in authenticated users' browsers through crafted URLs, requiring no user interaction beyond opening the link. During authorized testing, researchers weaponized the vulnerability to silently grant surrogate delegation privileges, enabling one account to act on behalf of another in the PLM system that manages critical engineering designs, bills of materials, and approval workflows for aircraft, vehicles, and industrial hardware. The vulnerability affects Teamcenter's /auth/login-redirect flow where user-controlled query parameters are reflected into HTML form attributes without proper encoding, and the page's automatic form submission triggers the injected code execution. This incident highlights the growing sophistication of application-layer attacks targeting industrial control systems and engineering environments, where a single compromised account can impact manufacturing approvals and intellectual property protection across aerospace and automotive sectors.
PEERSTITCH Malware Exposes Critical Gaps in Network Security Architecture
In September 2024, threat actors tracked as CL-STA-0954 exploited CVE-2024-47575 (FortiJump) to compromise a telecommunications organization's FortiManager appliance, leading to the exfiltration of configurations and cryptographic material for over 500 managed FortiGate firewalls. The attackers deployed PEERSTITCH, a sophisticated memory-resident ARM64 malware that operates without persistent files or network connections, using inter-process communication to establish covert channels within FortiOS daemons. The threat actors demonstrated advanced tradecraft by maintaining long-term access, intercepting network traffic, establishing unauthorized VPN sessions, and impersonating the management platform to target additional infrastructure. This incident highlights the growing threat of centralized management platform attacks, where compromising a single appliance can expose the security posture of hundreds of downstream devices and client networks, representing a critical supply chain risk for managed service providers.