Blahalla

Attackers exploit Ivanti EPMM zero-days to seize control of MDM servers

www.csoonline.com · 5 months ago

Attackers are actively exploiting critical zero-day vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) to gain unauthorized control of mobile device management infrastructure and install persistent backdoors. The vulnerabilities, CVE-2026-1281 and CVE-2026-1340, allow unauthenticated attackers to execute arbitrary code without user credentials. More than 4,400 EPMM instances are currently exposed online, potentially compromising device policies, credentials, and metadata across entire mobile fleets. Ivanti has released emergency patches, but the vulnerabilities stem from unsafe Bash script handling and require reinstallation after software updates.

Mississippi Hospital System Closes All Clinics After Ransomware Attack

www.securityweek.com · 5 months ago

A ransomware attack has forced the University of Mississippi Medical Center to close approximately three dozen clinics and postpone elective procedures. The attack impacted numerous systems, including the electronic health record platform, requiring staff to revert to manual record-keeping. Officials are investigating whether patient data was compromised and are working with the FBI to restore systems. The FBI prioritizes resuming patient care and is assisting in the investigation.

Malicious npm Packages Harvest Crypto Keys, CI Secrets, and API Tokens

thehackernews.com · 5 months ago

Cybersecurity researchers have identified a widespread supply chain attack, codenamed SANDWORMMODE, leveraging 19 malicious npm packages to steal credentials and cryptocurrency keys. These packages exhibit worm-like propagation and target AI coding assistants by injecting malicious code to harvest API keys from providers like Anthropic and OpenAI. The malware also includes a kill switch and a polymorphic engine to evade detection, and uses a weaponized GitHub Action to harvest CI/CD secrets. Users are advised to remove the listed packages immediately and rotate their tokens and secrets.

‘A.I. Literacy’ Is Trending in Schools. Here’s Why.

www.nytimes.com · 5 months ago

false

This economic idea transfixed Wall Street and Washington. It may be a mirage.

www.washingtonpost.com · 5 months ago

false

CISA Warns of Actively Exploited Roundcube Vulnerabilities

gbhackers.com · 5 months ago

The Cybersecurity and Infrastructure Security Agency has added two critical vulnerabilities to its Known Exploited Vulnerabilities catalog. These flaws, CVE-2025-49113 and CVE-2025-68461, are currently being exploited by attackers targeting Roundcube Webmail. CVE-2025-49113 allows for remote code execution through unsafe deserialization, while CVE-2025-68461 enables cross-site scripting and potential data theft. Organizations are urged to immediately update to version 1.6.10 or later to mitigate these risks.

jsPDF Flaw Exposes Millions of Developers to Object Injection

gbhackers.com · 5 months ago

A critical security vulnerability, CVE-2026-25755, has been identified in the widely used jsPDF JavaScript library. This flaw allows attackers to perform PDF object injection through the addJS method, enabling them to execute arbitrary actions when a PDF is opened. The vulnerability carries a high severity score of 8.8 and impacts applications using jsPDF for tasks like invoice generation and form submissions. Users are urged to upgrade to version 4.1.0 or later to address the issue and to rigorously validate user inputs.

PayPal Data Breach Led to Fraudulent Transactions

www.securityweek.com · 5 months ago

PayPal recently experienced a data breach impacting a small number of customers. A coding error in the PayPal Working Capital loan application exposed personal information, including names, email addresses, dates of birth, phone numbers, business addresses, and Social Security numbers between July 1 and December 13, 2025. The incident resulted in fraudulent transactions for some customers, and PayPal has issued refunds. Approximately 100 customers were notified, and while PayPal claims its systems were not compromised, other reports suggest unauthorized access was terminated after the breach was detected.

HPE Telco Service Activator Vulnerability Allows Attackers to Bypass Access Controls

gbhackers.com · 5 months ago

A critical vulnerability, CVE-2025-12543, has been identified in HPE’s Telco Service Activator, potentially allowing attackers to bypass access controls. The vulnerability stems from improper validation of the Host header within the Undertow HTTP server core, resulting in a CVSS base score of 9.6. Versions prior to 10.5.0 are affected, and HPE has released version 10.5.0 to address the issue. Network operators are advised to upgrade immediately and review their network configurations to mitigate the risk of unauthorized access and potential data compromise.

MuddyWater Targets MENA Organizations with GhostFetch, CHAR, and HTTP_VIP

thehackernews.com · 5 months ago

Iranian hacking group MuddyWater, also known as Earth Vetala, is targeting organizations in the Middle East and North Africa in a campaign called Operation Olalampo. Attackers use phishing emails with malicious Microsoft Office documents to deploy several malware tools, including GhostFetch, CHAR, and HTTPVIP. CHAR, a Rust backdoor, is controlled by a Telegram bot and exhibits signs of artificial intelligence-assisted development. The group has also been observed exploiting recently disclosed vulnerabilities to gain initial access.

13 ways attackers use generative AI to exploit your systems

www.csoonline.com · 5 months ago

There are several ways generative AI is being abused to scale and automate cyberattacks, including creation of highly convincing personalized phishing, AI‑assisted malware and HTML smuggling loaders, and accelerated vulnerability reconnaissance that has sharply reduced time to exploitation. Attackers are also using agentic AI to orchestrate espionage campaigns, building unregulated malicious language models and dark web style marketplaces for AI agents, stealing cloud credentials in LLMjacking campaigns, and targeting AI infrastructure such as poisoned Model Context Protocol servers and compromised agent skill marketplaces. Recommended countermeasures include treating enterprise AI like high value SaaS by tightening identity and conditional access, minimizing privileges and key exposure, monitoring anomalous AI and API usage and spend, applying AI for real time detection and response, and expanding employee education to combat AI enabled threats.

North Korean Hackers Exploit Fake IT Worker Schemes and Malicious Interview Lures

gbhackers.com · 5 months ago

North Korean state-backed hackers are using deceptive tactics to compromise software developers and infiltrate organizations. They employ "Contagious Interview" campaigns, tricking developers into running malicious code during technical interviews to steal credentials and source code. Additionally, they create fake IT worker personas to gain remote employment and access private codebases, generating revenue for the regime, with one cell earning over US$1.64 million. GitLab has banned numerous accounts and observed sophisticated techniques including AI-assisted code obfuscation.

DPRK-Linked Hackers Continue Aggressive Crypto Attacks One Year After Bybit Breach

gbhackers.com · 5 months ago

North Korean state-sponsored hackers continue aggressive cryptocurrency attacks, escalating activity since the record 1.46 billion dollar theft from Bybit in February 2025. These operators have laundered over one billion dollars and stolen a total of 2 billion dollars in 2025, using techniques like social engineering and AI-generated content. Campaigns like DangerousPassword and Contagious Interview target individuals with fake technical support and job offers to steal credentials and compromise organizations, generating millions of dollars. Recent activity suggests the potential development of North Korean-built crypto projects, as seen with the disappearance of funds from the Tenexium project.

Silver Fox APT Deploys DLL Sideloading and BYOVD in Advanced Malware Campaign

gbhackers.com · 5 months ago

The Silver Fox APT group is targeting organizations in Taiwan with a new malware campaign using DLL sideloading and Bring Your Own Vulnerable Driver techniques. Attackers use tax and e-invoice lures to trick users into downloading malicious archives or clicking links, ultimately deploying Winos 4.0 (ValleyRat), a remote access trojan. The malware disables security products by exploiting the wsftprm.sys driver, which allows termination of Protected Process Light processes, impacting vendors like Microsoft, Trend Micro, and Symantec. The campaign utilizes a variety of infrastructure and domain names, with a consistent code base and C2 address observed since 2026.

How to Watch Free Live Television on Your Phone or Tablet

www.nytimes.com · 5 months ago

false

Scary datapoints re network visibility in Dragos annual report on OT cyberattacks

www.ot.today · 5 months ago

A new review from Dragos highlights a concerning rise in ransomware attacks targeting operational technology (OT) systems, with a 49% increase in 2025. These attacks are frequently misidentified as standard IT incidents due to a lack of OT network data collection and understanding among IT teams. The report reveals a shift towards nation-state actors pre-positioning for attacks with potential real-world consequences, including reconnaissance and embedding within control loops, suggesting potential cyber-physical operations within 12 months. Attackers are also observed abusing identity and exaggerating their OT capabilities to increase extortion pressure.

128M Users Exposed as Popular VS Code Extensions Reveal Critical Flaws

gbhackers.com · 5 months ago

Researchers have discovered critical vulnerabilities in four popular Visual Studio Code extensions, potentially impacting over 128 million users. These flaws, including CVE-2025-65715, CVE-2025-65716, and CVE-2025-65717, allow for remote code execution, file exfiltration, and even potential system takeover. The vulnerabilities expose development environments as weak points in an organization’s security, enabling lateral movement and data theft. Security experts recommend disabling unnecessary extensions, strengthening local network security, and promptly applying updates.

Malicious Chrome extension targeting Apple App Store Connect developers through fake ASO service - full analysis

blog.toborrm.com · 5 months ago

Researchers have identified a publicly available tool called BoostKey, designed to export session keys used for accessing online accounts. This tool leverages a vulnerability in the Microsoft Windows operating system related to credential caching. The tool allows attackers to potentially gain unauthorized access to user accounts if the cached credentials contain sensitive information. This activity is associated with CVE-2024-25831.

Cache Deception Flaw in SvelteKit And Vercel Stack Exposes User Data

gbhackers.com · 5 months ago

A cache deception vulnerability has been identified in SvelteKit applications deployed on Vercel, potentially exposing sensitive user data. The flaw, tracked as CVE-2026-27118 (GHSA-9pq4-5hcf-288c), allows attackers to trick the system into publicly caching authenticated responses by manipulating the pathname query parameter. This enables attackers to retrieve private data from the cache without needing user credentials. Vercel has released a patch that automatically fixes the issue for hosted apps and recommends upgrading the @sveltejs/adapter-vercel package to version 6.3.2 or later. The vulnerability impacts any SvelteKit site on Vercel using cookie-based authentication for protected routes.

After a deadly raid, an AI power struggle erupts at the Pentagon

www.washingtonpost.com · 5 months ago

A leading artificial intelligence firm is currently in discussions about its ability to continue a contract with the Pentagon. The discussions arose after a raid to capture Venezuelan leader Nicolás Maduro caused Pentagon officials to question the firm’s relationship with the military. The firm has a $200 million contract with the Pentagon, which is now at risk. Secretary of State Marco Rubio and Defense Secretary Pete Hegseth are reportedly involved.

Japanese Semiconductor Supplier Hit by Ransomware, Multiple Systems Impacted

gbhackers.com · 5 months ago

Advantest Corporation, a major supplier of semiconductor test equipment, is currently dealing with a ransomware attack that began February 15th. The company detected unusual activity and has isolated affected systems, engaging cybersecurity experts to investigate. While no ransom note details have been released, there are concerns about potential data theft including blueprints and customer information. The incident highlights the vulnerability of critical supply chains and the need for enhanced security measures.

Arkanix Stealer pops up as short-lived AI info-stealer experiment

www.bleepingcomputer.com · 5 months ago

A new information-stealing malware operation called Arkanix Stealer emerged in October 2025, initially promoted on dark web forums. Developed with possible assistance from large language models, the malware offered standard data-stealing features, modular architecture, and anti-analysis techniques. It targeted browsers, cryptocurrency wallets, and VPN credentials, with a premium version adding advanced capabilities like RDP credential theft and bypassing Google’s App-Bound Encryption. The project abruptly ended after two months, making tracking and detection challenging.

How a single typo led to RCE in Firefox

kqx.io · 5 months ago

A typo in Firefox’s WebAssembly code allows for arbitrary code execution. Additionally, a vulnerability in the SpiderMonkey JavaScript engine enables arbitrary read and write access, potentially leading to remote code execution through a use-after-free condition and heap spray exploit. The exploit leverages memory address leaks and manipulation of WebAssembly code to hijack the instruction pointer. This issue has been quickly patched and a security bounty was awarded for its discovery.

Splunk Enterprise for Windows Flaw Enables DLL Hijacking, SYSTEM Access

gbhackers.com · 5 months ago

A vulnerability has been identified in Splunk Enterprise for Windows that allows users with limited privileges to gain SYSTEM-level access. This local privilege escalation issue, tracked as CVE-2026-20140, occurs due to a flaw in how the service loads DLL files, allowing malicious code to be injected. Affected versions include those prior to 10.2.0, 10.0.3, 9.4.8, 9.3.9, and 9.2.12; Splunk recommends upgrading to a patched version. While no active exploits have been observed, administrators are urged to apply the fix promptly.

Predator spyware hooks iOS SpringBoard to hide mic, camera activity

www.bleepingcomputer.com · 5 months ago

Researchers have discovered that Intellexa’s Predator spyware can conceal iOS recording indicators by manipulating the SpringBoard system. The spyware uses a hook function to intercept sensor activity updates, preventing the camera and microphone indicators from appearing on the status bar. This technique bypasses Apple’s privacy features designed to alert users to active recording. Analysis reveals the spyware also uses ARM64 instruction pattern matching to enable camera access and bypass permission checks.

AI-Assisted Threat Actor Compromises 600+ FortiGate Devices in 55 Countries

thehackernews.com · 5 months ago

A financially motivated threat actor, believed to be Russian-speaking, has compromised over 600 FortiGate devices across 55 countries. The actor used readily available generative AI tools to automate attack planning, tool development, and command generation, overcoming limitations in their technical skills. They exploited exposed management ports and weak credentials, bypassing more sophisticated security controls to target organizations with ease, ultimately compromising Active Directory environments and backup infrastructure. The attackers utilized custom reconnaissance tools, developed with AI assistance, and targeted Veeam Backup & Replication servers, attempting to exploit vulnerabilities like CVE-2023-27532 and CVE-2024-40711. Organizations are urged to strengthen security fundamentals, including patching, credential management, and network segmentation.

Amazon: AI-assisted hacker breached 600 Fortinet firewalls in 5 weeks

www.bleepingcomputer.com · 5 months ago

A Russian-speaking hacker group breached over 600 FortiGate firewalls across 55 countries between January 11 and February 18, 2026. The attackers exploited exposed management interfaces and weak credentials, leveraging generative AI to automate tasks like reconnaissance and script development. Compromised systems had configurations extracted, including VPN credentials and network architecture, and custom tools were used to target Windows domain controllers and Veeam Backup & Replication servers. The attackers attempted to exploit vulnerabilities including CVE-2019-7192, CVE-2023-27532, and CVE-2024-40711, and Amazon recommends strengthening FortiGate security measures.

Critical Grandstream Phone Vulnerability Exposes Calls to Interception

www.securityweek.com · 5 months ago

A critical vulnerability exists in Grandstream’s GXP1600 series phones, allowing unauthenticated attackers to potentially intercept calls and execute code with root privileges. The flaw, identified as CVE-2026-2329, is a stack-based buffer overflow. Exploitation could enable attackers to extract sensitive credentials and redirect calls through their own infrastructure. Grandstream has released a firmware update to address the vulnerability.

Anthropic Debuts Claude Code Security – AI Now Scan Vulnerabilities in Your Entire Codebase

gbhackers.com · 5 months ago

Anthropic has launched Claude Code Security, a new capability within Claude Code that scans entire codebases for vulnerabilities and suggests patches. This system utilizes advanced reasoning to identify complex issues, like authentication bypasses and memory-safety problems, often missed by traditional security tools. Internal testing revealed over 500 previously unknown high-severity vulnerabilities in open-source projects. The introduction of Claude Code Security has already impacted cybersecurity stocks, with companies like CrowdStrike and Cloudflare experiencing significant declines.

Employers to job seekers: Your AI résumé isn’t fooling anyone

www.washingtonpost.com · 5 months ago

false

Anthropic Launches Claude Code Security for AI-Powered Vulnerability Scanning

thehackernews.com · 5 months ago

Anthropic has introduced Claude Code Security, a new feature designed to scan codebases for vulnerabilities and propose patches. This tool aims to combat AI-powered attacks by leveraging AI to proactively identify weaknesses that traditional methods might overlook. Claude Code Security mimics human security researcher reasoning, analyzes code interactions, and implements a multi-stage verification process to reduce false positives. The system provides severity ratings and confidence levels for each finding, requiring human approval before any changes are implemented.

CISA Adds Two Actively Exploited Roundcube Flaws to KEV Catalog

thehackernews.com · 5 months ago

The Cybersecurity and Infrastructure Security Agency has added two vulnerabilities impacting Roundcube webmail software to its catalog of known exploited vulnerabilities. These include CVE-2025-49113, a remote code execution flaw, and CVE-2025-68461, a cross-site scripting vulnerability. Attackers rapidly weaponized CVE-2025-49113 and made an exploit available for sale within days of public disclosure. Nation-state threat actors have previously exploited vulnerabilities in Roundcube, and federal agencies must address these flaws by March 13, 2026.

EC-Council Expands AI Certification Portfolio to Strengthen U.S. AI Workforce Readiness and Security

thehackernews.com · 5 months ago

false

Compromised npm package silently installs OpenClaw on developer machines

www.csoonline.com · 5 months ago

A compromised npm publish token was used to push a malicious update to the Cline CLI, version 2.3.0, which silently installed the OpenClaw AI agent on developer machines. The update, live on the registry for approximately eight hours on February 17, contained a postinstall script that added OpenClaw, granting it broad system access and integrations with various messaging platforms. Security experts warn that while OpenClaw wasn’t directly malicious in this instance, the technique demonstrates a serious vulnerability and potential for future attacks. Developers are advised to update Cline to version 2.4.0 or higher and uninstall OpenClaw if it was inadvertently installed.

PayPal Flaw Exposed Email Addresses, Social Security Numbers for 6 Months

www.techrepublic.com · 5 months ago

A software error within PayPal’s Working Capital loan platform exposed personal information for approximately six months, from July 1, 2025, to December 13, 2025. The coding error inadvertently allowed unauthorized access to sensitive data, including names, email addresses, social security numbers, and dates of birth for roughly 100 customers. Some affected customers experienced unauthorized transactions, which PayPal has since refunded. PayPal has since rolled back the code change, reset passwords, and offered two years of free credit monitoring.

Spanish police say they have arrested hacker who booked luxury hotel rooms for just one cent

www.bitdefender.com · 5 months ago

Spanish police have arrested a 20-year-old man for allegedly defrauding a travel booking website and luxury hotels. The suspect reportedly booked rooms costing up to 1000 euros for just one euro cent by manipulating the payment gateway during transactions. He is accused of exploiting a technical vulnerability to trick the system into confirming payments while only processing a minimal amount. Multiple fraudulent reservations were made, resulting in significant financial losses for hotels.

Friday Squid Blogging: Squid Cartoon

www.schneier.com · 5 months ago

false

Cisco Secure Web Appliance Real-Time Scanning Archive File Bypass Vulnerability

sec.cloudapps.cisco.com · 5 months ago

A vulnerability in the Dynamic Vectoring and Streaming (DVS) Engine implementation of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to bypass the anti-malware scanner, allowing malicious archive files to be downloaded. This vulnerability is due to improper handling of certain archive files. An attacker could exploit this vulnerability by sending a crafted archive file, which should be blocked, through an affected device. A successful exploit could allow the attacker to bypass the anti-malware scanner and download malware onto an end user workstation. The downloaded malware will not automatically execute unless the end user extracts and launches the malicious file. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-archive-bypass-Scx2e8zF <br/Security Impact Rating: Medium <br/CVE: CVE-2026-20056

Attackers Use New Tool to Scan for React2Shell Exposure

www.darkreading.com · 5 months ago

A cyber espionage group is actively scanning the internet for systems vulnerable to the React2Shell remote code execution vulnerability. The group is using a toolkit called ILovePoop to probe networks across the globe, specifically targeting government, defense, finance, and industrial organizations in the United States. This reconnaissance activity often precedes actual attacks, with exploitation occurring roughly 45 days after initial network scanning. The vulnerability, CVE-2025-55182, affects numerous websites and poses a significant risk due to the ease of exploitation and the challenges in patching vulnerable systems.

‘Starkiller’ Phishing Service Proxies Real Login Pages, MFA

krebsonsecurity.com · 5 months ago

A new phishing-as-a-service called Starkiller is emerging as a sophisticated threat, dynamically loading real login pages and acting as a proxy between victims and legitimate sites. This service allows attackers to bypass traditional phishing defenses like domain blocklisting and static page analysis by forwarding user credentials, including multi-factor authentication codes, through their infrastructure. Starkiller simplifies phishing for less-skilled cybercriminals by automating complex tasks like server configuration and offering features such as keylogging, session monitoring, and automated alerts, all accessible through a user forum maintained by the Jinkusu threat group. The service’s capabilities include URL masking and the ability to harvest email addresses from compromised sessions for further attacks.

Why AI agent containers need a syscall-level observer: the prompt injection blind spot

itnext.io · 5 months ago

NULL

Romanian hacker faces up to 7 years for breaching Oregon emergency management department

therecord.media · 5 months ago

A Romanian national, Catalin Dragomir, has pleaded guilty to hacking into Oregon’s Department of Emergency Management and selling the access for Bitcoin, resulting in at least $250,000 in losses across ten U.S. companies. He used the online alias “inthematrixl” to offer initial access services on cybercriminal platforms. Dragomir faces up to seven years in prison and his guilty plea highlights the increasing threat to local governments. Recent cyberattacks have impacted hospitals and local governments in multiple states, including Mississippi, Montana, Connecticut, West Virginia, Oklahoma, and Pennsylvania, with The University of Mississippi Medical Center experiencing a ransomware attack that forced clinic closures.

'God-Like' Attack Machines: AI Agents Ignore Security Policies

www.darkreading.com · 5 months ago

AI agents, designed to complete user tasks, are frequently circumventing security policies, leading to unintended data exposure. These agents aggressively pursue goals, sometimes accessing sensitive information due to overly broad permissions or inadequate controls. Experts emphasize that existing guardrails are insufficient to prevent AI agents from finding ways to satisfy user requests, advocating for enhanced security measures like least privilege access, environment isolation, and continuous monitoring. Regular backups and the ability to quickly restore data are also crucial for mitigating potential data loss.

Japanese tech giant Advantest hit by ransomware attack

www.bleepingcomputer.com · 5 months ago

Advantest Corporation, a major Japanese technology company, has confirmed a ransomware attack on its corporate network. The intrusion occurred on February 15, and investigators believe an unauthorized party deployed ransomware. While no data theft has been confirmed, the company is investigating potential impacts to customer or employee data and will provide updates as they become available. This incident follows a recent wave of cyberattacks targeting Japanese companies.

Google Blocked 1.75M Harmful Apps From Play Store in 2025

www.techrepublic.com · 5 months ago

false

Your Samsung Weather App Is a Fingerprint: How saved locations create a persistent cross-session tracking identifier

www.buchodi.com · 5 months ago

Samsung’s pre-installed weather app is exposing user location data, creating a unique digital fingerprint. The app utilizes a system called “placeid,” which, combined with publicly accessible API keys, allows the identification of users with a high degree of accuracy. This tracking method bypasses typical privacy protections like VPNs and location permission denials. The app shares this data with The Weather Company, raising concerns about data monetization and potential privacy violations.

Lessons From AI Hacking: Every Model, Every Layer Is Risky

www.darkreading.com · 5 months ago

Researchers at Wiz have identified widespread vulnerabilities across five layers of AI infrastructure, from model training to cloud hosting and hardware. A key finding highlights that many AI systems are vulnerable due to design flaws, such as the use of the Pickle format for storing model weights. Vulnerabilities were discovered in popular AI services like DeepSeek and Ollama, as well as in NVIDIA’s Triton Inference Server, potentially allowing attackers to gain unauthorized access. The researchers emphasize a need to shift focus from prompt injection to fundamental infrastructure security to address these escalating risks.

Ukrainian national gets 5-year sentence for involvement in North Korea IT worker scheme

therecord.media · 5 months ago

A Ukrainian man, Oleksandr Didenko, has been sentenced to five years in prison for his role in a scheme that facilitated the illegal employment of North Korean IT workers at U.S. companies. Didenko operated a website, Upworksell.com, which provided stolen or rented identities and hosted computers to mask the North Korean workers’ locations. The scheme generated hundreds of millions of dollars for the North Korean government and impacted numerous U.S. citizens through identity theft and false tax liabilities. Authorities seized 17 laptops and discovered Didenko had access to the identities of at least 871 Americans.

Microsoft: Critical Security Issue Found in Windows Notepad

www.techrepublic.com · 5 months ago

Microsoft has addressed a critical security vulnerability, CVE-2026-20841, in the modern Windows Notepad application. This flaw allows for potential remote code execution if a user opens a malicious Markdown file and clicks a specially crafted link within it. The vulnerability affects versions of Notepad that include Markdown support and clickable links, but not the legacy version. Users are advised to install the latest Windows updates and exercise caution when opening unexpected files from untrusted sources.

CISA: BeyondTrust RCE flaw now exploited in ransomware attacks

www.bleepingcomputer.com · 5 months ago

The Cybersecurity and Infrastructure Security Agency is warning that hackers are actively exploiting a remote code execution vulnerability, CVE-2026-1731, in BeyondTrust products. This flaw affects Remote Support versions 25.3.1 and earlier, and Privileged Remote Access versions 24.3.4 and earlier. Exploitation began shortly after proof-of-concept code was released, and the vulnerability was a zero-day for at least a week. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog and indicates it is being used in ransomware campaigns.