Find what you’re looking for
Browse everything
6,917 results in Threat Reports
Underminr Exploit: A New Threat to Web Security
In May 2026, researchers identified a critical vulnerability named 'Underminr' that exploits weaknesses in content delivery networks (CDNs) and Domain Name System (DNS) configurations. This exploit allows threat actors to manipulate web requests, enabling them to mask malicious activities behind the trusted reputations of legitimate websites. By leveraging this technique, attackers can conduct phishing campaigns, distribute malware, and perform data exfiltration while appearing to originate from reputable domains. The widespread nature of this vulnerability poses significant risks to organizations relying on CDNs for web content delivery. The emergence of Underminr underscores the evolving tactics of cyber adversaries who are increasingly targeting foundational internet infrastructure. This trend highlights the necessity for organizations to reassess their security postures, particularly concerning third-party services like CDNs, and to implement robust monitoring and mitigation strategies to defend against such sophisticated attacks.
Chinese APTs Deploy 'Showboat' Linux Backdoor in Central Asia Telco Attacks
In May 2026, Chinese state-aligned Advanced Persistent Threat (APT) groups were discovered using a Linux-based post-exploitation framework named 'Showboat' to infiltrate telecommunications companies in Central Asia. The malware enables attackers to scan and infect devices on local area networks (LANs) that are not connected to the public Internet, facilitating long-term espionage activities. Notably, the APT group Calypso has been identified leveraging Showboat alongside a Windows backdoor called 'JFMBackdoor' to target entities in Afghanistan, Kazakhstan, Turkey, and India. This incident underscores the evolving tactics of Chinese APTs in targeting critical infrastructure sectors, particularly telecommunications, using cross-platform malware to maintain persistent access and conduct intelligence gathering. The discovery of Showboat highlights the need for enhanced cybersecurity measures to detect and mitigate such sophisticated threats.
Drupal CVE-2026-9082: Critical SQL Injection Vulnerability in PostgreSQL Deployments
On May 20, 2026, Drupal released security updates addressing a highly critical SQL injection vulnerability (CVE-2026-9082) in its core database abstraction API. This flaw allows anonymous attackers to send specially crafted requests, leading to arbitrary SQL injection on sites using PostgreSQL databases. Exploitation can result in information disclosure, privilege escalation, and potentially remote code execution. The vulnerability affects Drupal versions from 8.9.0 up to 11.3.9, with patched versions available in 11.3.10, 11.2.12, 11.1.10, 10.6.9, 10.5.10, and 10.4.10. ([drupal.org](https://www.drupal.org/sa-core-2026-004?utm_source=openai)) This incident underscores the persistent threat of SQL injection vulnerabilities in widely used content management systems. Organizations utilizing Drupal with PostgreSQL should prioritize immediate patching to mitigate potential exploitation. The ease of anonymous exploitation highlights the necessity for robust security practices and timely updates to protect sensitive data and maintain system integrity.
GitHub Breach: Lessons in Securing Developer Tools Against Supply Chain Attacks
In May 2026, GitHub experienced a significant security breach when an employee's device was compromised through a malicious version of the Nx Console Visual Studio Code (VS Code) extension. This supply chain attack, orchestrated by the cybercriminal group TeamPCP, led to unauthorized access and exfiltration of approximately 3,800 internal repositories. The attackers exploited the compromised extension to harvest sensitive data, including source code and operational information. GitHub promptly detected the intrusion, removed the malicious extension, isolated the affected endpoint, and initiated an internal investigation to assess the full impact and prevent further unauthorized access. This incident underscores the escalating threat of supply chain attacks targeting developer tools and extensions. The rapid proliferation of such attacks highlights the critical need for organizations to implement stringent security measures, conduct regular audits of third-party tools, and foster a culture of security awareness among developers to mitigate potential vulnerabilities.
Critical Linux Kernel Vulnerability Discovered After Nine Years
In May 2026, cybersecurity researchers disclosed a nine-year-old vulnerability in the Linux kernel, identified as CVE-2026-46333, also known as 'ssh-keysign-pwn'. This flaw allows unprivileged local users to access sensitive files and execute arbitrary commands with root privileges on default installations of major distributions like Debian, Fedora, and Ubuntu. The vulnerability originates from improper privilege management in the kernel's __ptrace_may_access() function, introduced in November 2016. Exploitation can lead to the disclosure of critical files such as /etc/shadow and SSH host private keys, posing significant security risks. The discovery of this long-standing vulnerability underscores the importance of continuous security assessments and prompt patching in open-source software. With a proof-of-concept exploit publicly available, organizations are urged to apply the latest kernel updates immediately to mitigate potential threats.
Critical Vulnerabilities in ABB B&R Automation Runtime Threaten Industrial Systems
In October 2025, ABB B&R Automation Runtime versions prior to 6.4 were found to have multiple vulnerabilities, including CVE-2025-3449, CVE-2025-3448, and CVE-2025-11498. These flaws could allow unauthenticated attackers to hijack sessions, execute arbitrary JavaScript in users' browsers, and inject malicious formulas into CSV files. Exploitation required network access and user interaction, posing significant risks to industrial control systems. The discovery of these vulnerabilities underscores the critical need for robust security measures in industrial automation environments. As cyber threats targeting operational technology increase, organizations must prioritize timely updates and comprehensive security practices to safeguard against potential exploits.
Critical Privilege Escalation Vulnerability in Microsoft Defender (CVE-2026-41091)
In May 2026, Microsoft disclosed a critical vulnerability in Microsoft Defender, identified as CVE-2026-41091, which allows local privilege escalation due to improper link resolution before file access. This flaw enables authenticated attackers to gain SYSTEM privileges by exploiting how Defender processes symbolic and hard links, potentially leading to unauthorized code execution with elevated rights. The vulnerability has been actively exploited in the wild, prompting immediate security advisories and patch releases. The active exploitation of CVE-2026-41091 underscores the persistent targeting of security software by threat actors to escalate privileges and compromise systems. Organizations are urged to apply the latest patches to Microsoft Defender promptly to mitigate this risk and prevent potential breaches resulting from this vulnerability.
Critical Vulnerabilities Discovered in ABB Terra AC Wallbox EV Chargers
In September 2025, ABB identified multiple buffer overflow vulnerabilities in its Terra AC Wallbox electric vehicle chargers, specifically affecting firmware versions up to 1.8.33. These vulnerabilities, cataloged as CVE-2025-10504, CVE-2025-12142, and CVE-2025-12143, could allow attackers with adjacent network access and high privileges to execute arbitrary code, potentially leading to unauthorized control over the device. ABB promptly released firmware version 1.8.36 to address these issues and recommended immediate updates to mitigate potential risks. The discovery of these vulnerabilities underscores the critical importance of securing IoT devices, especially those connected to critical infrastructure like energy distribution. As the adoption of electric vehicle chargers grows, ensuring robust cybersecurity measures is essential to prevent potential exploitation that could disrupt services and compromise user safety.
Critical OpenSSL Vulnerability in Hitachi Energy's GMS600: CVE-2022-4304
In 2023, Hitachi Energy identified a vulnerability (CVE-2022-4304) in its GMS600 versions 1.3.0 and 1.3.1, stemming from a timing-based side channel in the OpenSSL RSA decryption implementation. This flaw could potentially allow attackers to recover plaintext across a network through a Bleichenbacher-style attack, necessitating the transmission of a large number of trial messages. Successful exploitation could lead to the decryption of sensitive application data transmitted over TLS connections. ([cve.mitre.org](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4304&utm_source=openai)) This incident underscores the critical importance of promptly addressing vulnerabilities in widely used cryptographic libraries like OpenSSL. Organizations must remain vigilant, as similar flaws can have far-reaching implications across various products and industries, emphasizing the need for continuous monitoring and timely patching to maintain robust cybersecurity defenses.
Mini Shai Hulud: @antv npm Supply Chain Attack Exposes CI/CD Credentials
In May 2026, a supply chain attack targeted the @antv npm package ecosystem. A threat actor compromised an @antv maintainer account, publishing malicious versions of popular data-visualization packages. This led to widespread impact, as the malicious code propagated through dependencies like echarts-for-react, affecting CI/CD pipelines and cloud workloads. The payload, a 499 KB obfuscated JavaScript file, executed silently during npm install, aiming to steal credentials from GitHub Actions environments. Key features included multi-platform credential theft, process memory scraping, privilege escalation, dual-channel data exfiltration, and SLSA provenance forgery, indicating a sophisticated focus on CI/CD environments. This incident underscores the escalating threat of supply chain attacks, particularly targeting CI/CD environments. The attack's sophistication, including SLSA provenance forgery, highlights the need for enhanced security measures in software development pipelines to prevent unauthorized access and data breaches.
Trivy Supply Chain Compromise: A Wake-Up Call for Security Tool Integrity
In March 2026, Aqua Security's open-source vulnerability scanner, Trivy, was compromised in a sophisticated supply chain attack. Threat actors injected credential-stealing malware into Trivy's official releases, affecting the core scanner binary and associated GitHub Actions. This breach enabled attackers to harvest sensitive data from organizations relying on Trivy for security assessments. The campaign, attributed to the group TeamPCP, expanded to other security tools, including Checkmarx KICS and LiteLLM, indicating a targeted approach against security infrastructure. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/03/24/detecting-investigating-defending-against-trivy-supply-chain-compromise/?utm_source=openai)) This incident underscores the escalating trend of supply chain attacks targeting security tools, exploiting the trust placed in them by organizations. The compromise of widely used security applications highlights the need for enhanced vigilance and robust security measures within the software supply chain to prevent similar breaches.
Showboat Linux Malware Targets Middle East Telecoms in 2026
In mid-2022, a telecommunications provider in the Middle East was targeted by a sophisticated cyber espionage campaign involving a new Linux malware named Showboat. This modular post-exploitation framework is capable of spawning remote shells, transferring files, and functioning as a SOCKS5 proxy. The malware's design allows attackers to establish a persistent foothold within compromised systems, facilitating unauthorized access to internal networks and sensitive data. The campaign has been attributed to China-linked threat actors, with command-and-control infrastructure traced back to Chengdu, Sichuan province. The attackers likely exploited vulnerabilities or default remote access accounts to deploy the malware, underscoring the critical need for robust security measures in telecommunications infrastructure. This incident highlights a concerning trend of state-sponsored cyber espionage targeting critical infrastructure sectors, particularly telecommunications. The use of advanced, stealthy malware like Showboat demonstrates the evolving capabilities of threat actors and the importance of proactive defense strategies. Organizations must prioritize the implementation of comprehensive security protocols, regular system audits, and employee training to mitigate the risks posed by such sophisticated attacks.