Find what you’re looking for
Browse everything
6,838 results in Threat Reports
Critical SAP Cloud SDK Vulnerability Exposes OAuth2 Credentials in Multi-Tenant Environments
SAP disclosed a critical CVSS 10.0 vulnerability (CVE-2026-89111) in its Cloud SDK for Python that allows attackers to steal OAuth2 client credentials from multi-tenant applications on SAP Business Technology Platform. The flaw enables attackers who control tenant subdomains to redirect authentication requests to malicious servers, capturing sensitive client IDs and secrets. While initially patched in version 0.45.2 released August 21, 2026, subsequent versions 0.53.0 through 0.55.0 reintroduced the vulnerability in certain modules before being definitively fixed in version 0.55.1. This incident highlights the growing sophistication of supply chain attacks targeting cloud SDKs and authentication mechanisms. As organizations increasingly adopt multi-tenant cloud architectures and rely on third-party development tools, vulnerabilities in widely-used SDKs pose systemic risks across entire ecosystems of applications and services.
Docker Hub's Two-Year Critical Flaw: How CVE-2026-105445 Exposed Container Supply Chains
Docker fixed a critical vulnerability (CVE-2026-105445) in Docker Hub that allowed attackers to push, pull, or delete container images as other users. The flaw, dubbed GhostPat, existed for over two years from August 2024 to September 2026 and stemmed from improper handling of personal access tokens (PATs) during account-to-organization conversions. Attackers could create a token, convert their account to an organization, and designate another user as owner, thereby gaining registry access under that user's identity. While Docker found no evidence of exploitation after reviewing 304,000 pushes, the vulnerability posed significant supply chain risks by enabling malicious image publication under legitimate names. This incident highlights the growing sophistication of supply chain attacks targeting container registries, coinciding with increased focus on software supply chain security following recent high-profile compromises and new regulatory requirements for software bill of materials tracking.
The Gentlemen Ransomware Gang Industrialized EDR Evasion Into a Service Economy
The Gentlemen ransomware-as-a-service operation emerged in late 2025 and rapidly ascended to become a top-five ransomware gang by Q1 2026 through their innovative EDR killer framework. The crew developed an industrialized approach to endpoint detection and response evasion, creating eight or more variants of their GentleKiller tool that targets over 400 security processes across 48 different security products. By offering affiliates a generous 90% revenue share compared to the industry standard of 80%, Gentlemen scaled their operation through volume rather than per-incident margins, transforming EDR evasion from a technical skill barrier into a commodity service available to low-skill threat actors. This incident represents the maturation of the bring-your-own-vulnerable-driver (BYOVD) attack technique from isolated tactics into a full-scale economy with pricing tiers, product roadmaps, and customer support models, fundamentally changing the threat landscape defenders face.
SonicWall SMA Under Fire: CVE-2026-102255 Exploitation Reveals SSL-VPN Risks
In October 2026, threat actors began actively exploiting CVE-2026-102255, a maximum-severity SSRF vulnerability in SonicWall SMA 1000 appliances. The flaw allows remote unauthenticated attackers to abuse the WorkPlace interface, directing appliances to issue internal requests and perform unauthorized operations. Cybersecurity firms Previdian and Defused detected exploitation attempts on their honeypot devices within days of SonicWall's advisory, despite the vendor initially reporting no evidence of active exploitation. This incident highlights the ongoing targeting of SSL-VPN and edge devices by cybercriminals, following previous zero-day attacks on SonicWall products by the Inc ransomware gang in July 2026. The vulnerability's trivial exploitation combined with SMA devices' position between public internet and corporate resources creates significant risk for organizations relying on legacy SSL-VPN solutions.
Trusted Cybersecurity Executive Turned Alleged Extortionist: The Edward Dubrovsky Case
Edward Dubrovsky, a prominent 54-year-old cybersecurity executive and ransomware negotiator, was arrested in Pennsylvania in October 2026 on federal extortion charges under the Computer Fraud and Abuse Act. The Canadian-based security professional, who previously served as an executive at incident response firm Cypfer and authored strategic guides on cyber-extortion response, is suspected of involvement with the ShinyHunters cybercrime collective. FBI investigations suggest connections to the group's recent breach of FBIjobs.gov, where attackers claimed to have stolen data from nearly every FBI employee and job applicant. This case represents a significant insider threat scenario where a trusted cybersecurity professional allegedly participated in the very criminal activities they were supposed to defend against. This incident highlights the growing concern of insider threats within the cybersecurity industry itself, as professionals with privileged access and deep knowledge of defensive strategies increasingly become targets for recruitment by cybercriminal organizations or choose to monetize their expertise through illegal means.
GitLab's CVSS 10.0 Vulnerability Exposes Critical DevOps Security Gaps
GitLab released emergency patches for CVE-2026-97229, a maximum-severity vulnerability with a CVSS score of 10.0 that allows unauthenticated attackers to execute arbitrary code on GitLab servers. The integer overflow flaw exploits insufficient regular expression validation in CI/CD configurations, affecting all GitLab Community and Enterprise Edition versions from 19.2 to 19.4.1. Successful exploitation requires only a specially crafted regular expression in a CI/CD pipeline configuration, providing complete server compromise without authentication. The incident demonstrates the critical security risks in DevOps platforms where CI/CD pipeline vulnerabilities can provide direct server access. The disclosure follows a concerning pattern of maximum-severity GitLab vulnerabilities, including CVE-2026-85706 which saw active exploitation within hours of public disclosure, highlighting the urgent need for organizations to prioritize patch management in their DevSecOps environments.
Midnight Mimosa Malware Turns Android Phones Into Botnet Proxies Through Supply Chain Attack
The Midnight Mimosa campaign, discovered by Bitdefender in 2026, involved preinstalled malware on low-cost Android devices built on MediaTek platforms. The malware, embedded in device firmware with system-level privileges, allowed operators to remotely install apps, conduct ad fraud, and convert infected devices into residential proxy nodes for botnets. Affecting thousands of devices across 150+ countries over two years, the campaign primarily targeted users in Mexico, France, Italy, and the U.S. The supply chain compromise involved white-label and counterfeit devices, with firmware signed by certificates attributed to Shenzhen Zediel Co., Ltd. This incident highlights the growing threat of supply chain attacks targeting mobile ecosystems, as threat actors increasingly leverage firmware-level compromises to establish persistent access that bypasses traditional security controls and user awareness.
Critical MarkLogic Vulnerabilities Enable Persistent Admin Takeover
Progress Software disclosed 31 security vulnerabilities in MarkLogic Server on October 12, 2026, with five rated critical. Two of the most severe flaws (CVE-2026-85947 and CVE-2026-85948) allow accounts with limited management privileges to escalate to persistent administrator control of the database server. CVE-2026-85947 enables forest-management accounts to create persistent admin accounts, while CVE-2026-85948 exploits an XQuery injection flaw in deprecated Management API paths. The vulnerabilities affect MarkLogic 11.x before 11.3.7 and 12.x before 12.1.0, with fixes available since September 10, 2026. The disclosure follows another batch of 10 critical flaws published in August 2026, indicating an ongoing pattern of privilege escalation vulnerabilities in enterprise database platforms that require immediate attention from organizations relying on MarkLogic for mission-critical data management.
French Supermarket Cyberattack Exposes Critical IoT/OT Security Gaps
On October 11, 2026, attackers remotely compromised hundreds of French supermarkets by hijacking Danfoss refrigeration controllers, heating fridges and freezers to temperatures as high as 50°C. The attack affected major chains including Intermarché, Carrefour, and Coopérative U, forcing stores to discard millions of euros worth of food products. Attackers exploited vulnerabilities in older, unpatched Danfoss AK-SM and AK-SC controller models that were directly exposed to the internet without proper network segmentation or access controls. This unprecedented IoT/OT attack demonstrates the critical vulnerability of industrial control systems when proper cybersecurity measures are absent, highlighting the urgent need for better segmentation and lifecycle management of operational technology devices in retail infrastructure.
LG Smart TVs Vulnerable to Unauthenticated Root Takeover via Local Network
In October 2026, security researchers disclosed three critical vulnerabilities in LG's webOS that can be chained together to achieve unauthenticated root access on smart TVs from the local network. The attack exploits a pairing service on port 3001 used by the LG ThinQ app, leveraging a trusted test certificate to bypass PIN authentication and obtain privileged access. Attackers then abuse the PalmServiceBridge interface and pmlogd logging service to execute commands with root privileges. LG has issued firmware updates for affected models including 32LQ636BPSA and 27TQ600SW running webOS 7.5.7-25. This incident highlights the growing threat landscape targeting IoT devices, particularly as smart home ecosystems expand and become increasingly integrated into enterprise and residential networks. The attack demonstrates how legacy trust mechanisms and inadequate input validation continue to create critical security gaps in consumer devices.
Critical Authentication Bypass in Swann Security Cameras Exposes Video Surveillance
Three critical authentication bypass vulnerabilities (CVE-2026-107605, CVE-2026-107606, CVE-2026-107607) were discovered in Swann Communications SWIFI-SE2KIC security cameras running firmware version 2.0.22 and earlier. These Missing Authentication for Critical Function flaws allow attackers on the local network to access live video feeds, capture snapshots, and stream real-time video without any authentication credentials. The vulnerabilities affect security cameras deployed worldwide in commercial facilities, creating significant privacy and surveillance risks for organizations relying on these devices for physical security monitoring. This incident highlights the growing security risks in IoT surveillance infrastructure as organizations increasingly deploy connected cameras without proper network segmentation. With the rise of insider threats and lateral movement attacks targeting unsecured IoT devices, these authentication bypass vulnerabilities represent a critical gap in physical security systems that adversaries can exploit to gain unauthorized surveillance access.
Microsoft's Xandr Hit with Record €8.6M Fine for Grindr Data Privacy Violation
Norway's Data Protection Authority issued a record €8.6 million fine to Microsoft's Xandr advertising unit for illegally sharing Grindr users' sensitive personal data, including sexual orientation information, with thousands of advertisers between July 2018 and April 2020. The violation occurred through real-time bidding processes where Xandr acted as both buyer and seller, relaying user data without proper consent to enable targeted advertising auctions. This breach affected thousands of Norwegian users and represents the largest fine ever issued by Norway's DPA, highlighting serious regulatory enforcement against unauthorized data sharing practices. This case exemplifies the growing regulatory crackdown on data privacy violations in the advertising ecosystem, particularly around sensitive personal information and consent mechanisms, as authorities worldwide intensify enforcement of GDPR and similar privacy frameworks.