Blahalla

Cybersecurity Excellence Awards Reveal Nomination Shift from AI Hype to Governance Execution

gbhackers.com · 5 months ago

false

What 5 Million Apps Revealed About Secrets in JavaScript

www.bleepingcomputer.com · 5 months ago

Research involving a scan of 5 million applications revealed over 42,000 exposed secrets within JavaScript bundles, including API keys and tokens for services like GitHub, GitLab, and Linear. Traditional security scanning methods, including Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST), often fail to detect these secrets because they do not adequately analyze JavaScript files. Secrets can be introduced during the build and deployment process, bypassing initial security controls, highlighting the need for automated single-page application spidering for comprehensive protection.

Hackers target supporters of Iran protests in new espionage campaign

therecord.media · 5 months ago

Cybersecurity researchers have identified a new espionage campaign targeting supporters of Iran’s anti-government protests. The campaign, beginning in January, uses malicious files disguised as authentic protest footage to distribute the CRESCENTHARVEST malware. This previously unknown malware functions as a remote access trojan and information stealer, capable of keystroke logging and data extraction. The attackers are believed to be linked to Iran, and the campaign likely targets Iranians abroad or their supporters.

New Keenadu backdoor found in Android firmware, Google Play apps

www.bleepingcomputer.com · 5 months ago

A sophisticated Android malware called Keenadu has been discovered embedded in device firmware and distributed through various means, including Google Play apps. The malware compromises all installed applications and grants attackers unrestricted control over infected devices, potentially enabling data theft and other risky actions. Kaspersky has identified approximately 13,000 infected devices primarily located in Russia, Japan, Germany, Brazil, and the Netherlands. Removal is difficult, requiring a clean firmware installation or device replacement, and the malware appears to avoid devices using Chinese language and timezones.

API Threats Grow in Scale as AI Expands the Blast Radius

www.securityweek.com · 5 months ago

Application Programming Interface or API vulnerabilities are a growing threat, with API-related issues accounting for a significant percentage of published vulnerabilities and exploited weaknesses. Artificial intelligence is expanding the attack surface and amplifying existing API weaknesses, particularly through the rise of the Model Context Protocol or MCP. MCP vulnerabilities are rapidly increasing due to over-permissioned tools, direct API exposure, and a lack of runtime enforcement, making them difficult to fix due to the decentralized nature of the standard. Attackers are increasingly exploiting cross-site issues and injections, and most API vulnerabilities are easily exploited remotely, often without authentication.

Cyber Insights 2026: The Ongoing Fight to Secure Industrial Control Systems

www.securityweek.com · 5 months ago

Industrial Control Systems are facing a growing threat landscape with vulnerabilities stemming from aging infrastructure and the convergence of IT, OT, and IoT. Experts recommend focusing on identity security, continuous threat exposure management, and bolstering supply chain security through software bills of materials. Building resilience, or anti-fragility, is crucial as organizations shift away from reactive measures toward dynamic defenses and workforce development. Increased research and development is needed to address the rapid evolution of threats outpacing current improvements.

Dutch police arrest man who refused to delete confidential files shared by mistake

therecord.media · 5 months ago

Dutch police arrested a 40-year-old man after he refused to delete confidential law enforcement documents he received through a technical error. An officer mistakenly sent a download link instead of a secure upload link, granting the man access to the files. The suspect demanded something in return for deleting the documents, leading to his arrest and a search of his home. Authorities stated that downloading files after being instructed not to, and knowing they were not intended for you, could constitute computer trespassing.

Cybercriminals Exploit Atlassian Cloud to Launch Spam Campaigns Promoting Fraudulent Investments

gbhackers.com · 5 months ago

Cybercriminals exploited Atlassian Cloud's Jira system to distribute spam campaigns promoting fraudulent investments and online casinos between late 2025 and late 2026. Attackers created disposable Jira Cloud instances using free accounts and leveraged legitimate email authentication protocols like SPF and DKIM to bypass security controls. The campaigns utilized a Traffic Distribution System, Keitaro, to route recipients through intermediary platforms and were targeted based on language, geography, and industry, including Russian-speaking professionals. Security teams are advised to treat cloud-generated messages as potential threats, implement URL analysis, and monitor for unusual sending patterns.

Man Linked to Phobos Ransomware Arrested in Poland

www.securityweek.com · 5 months ago

Polish police have arrested a man suspected of involvement in the Phobos ransomware operation. Investigators found hacking tools, credentials, and communication logs linking him to the group on his devices. Authorities believe he may have been an affiliate of the ransomware-as-a-service operation, which emerged in 2019 and has targeted over 1,000 organizations worldwide, resulting in more than 16 million dollars in ransom payments. Recent international law enforcement actions have targeted Phobos infrastructure and key members.

SmartLoader Attack Uses Trojanized Oura MCP Server to Deploy StealC Infostealer

thehackernews.com · 5 months ago

Cybersecurity researchers have identified a new SmartLoader campaign using a compromised Model Context Protocol server linked to Oura Health to distribute the StealC infostealer. Threat actors created fake GitHub accounts and repositories to build credibility and submit the malicious server to legitimate registries. This sophisticated attack, taking months to develop, targets developers to steal sensitive data like API keys, cloud credentials, and cryptocurrency wallet information. Organizations are advised to verify the origin of MCP servers and monitor for unusual network activity.

Russia Set to Block Telegram Access Nationwide from April 1

gbhackers.com · 5 months ago

false

Washington Hotel in Japan Hit by Ransomware Attack

gbhackers.com · 5 months ago

Washington Hotel in Japan experienced a ransomware attack on February 13, 2026, resulting in unauthorized access to several servers. The hotel’s IT team immediately disconnected external networks and is collaborating with law enforcement and cybersecurity experts to investigate the breach and assess data exposure. While customer data from the hotel’s membership program appears secure, some business-critical data was compromised, and temporary issues affected credit card payment terminals. The company is working to restore systems and provide updates on the ongoing investigation.

Matanbuchus 3.0 Unleashes AstarionRAT via ClickFix Social Engineering and Silent MSI Installs

gbhackers.com · 5 months ago

Cybercriminals are employing a sophisticated intrusion chain utilizing social engineering and stealthy installation techniques. The attack begins with a ClickFix prompt that tricks users into executing a command, bypassing typical email filtering. This command silently installs a malicious MSI package from a brand-impersonating server, deploying files disguised as security software. The Matanbuchus 3.0 loader then decrypts and executes AstarionRAT, a remote access trojan capable of credential theft and network pivoting. The malware employs several layers of obfuscation and living-off-the-land techniques to evade detection and establish a foothold within compromised networks.

Log Poisoning in OpenClaw

research.eye.security · 5 months ago

Researchers discovered a potential vulnerability in the OpenClaw AI assistant where user-controlled data, specifically from WebSocket headers like User-Agent and Origin, was being logged without sanitization. This allowed for the possibility of indirect prompt injection, potentially influencing the agent's reasoning and actions if it processed those logs. The OpenClaw maintainers have since patched the vulnerability by removing user-controlled input from logging paths, limiting header sizes, and discouraging agents from consuming raw logs. No CVE has been issued.

ZeroDayRAT spyware targets Android and iOS devices via commercial toolkit

www.csoonline.com · 5 months ago

Researchers have identified ZeroDayRAT, a new cross-platform spyware available for purchase on Telegram. The toolkit enables surveillance, credential theft, and financial targeting across a broad range of Android and iOS devices, requiring minimal technical expertise to deploy. The spyware collects extensive data, including messages, call logs, account information from services like Google and WhatsApp, and can be used for real-time surveillance and financial theft. Infection occurs through social engineering, persuading users to install malicious applications or profiles.

India’s Largest Pharmacy Exposes Customer Personal Data and Internal System Access

gbhackers.com · 5 months ago

A security vulnerability has been discovered in Dava India, a large pharmacy chain, allowing unauthorized access to sensitive customer data and internal systems. A researcher found an insecure administrator API that exposed a list of administrator users and enabled the creation of new administrator accounts. This breach provided access to over 17,000 customer orders, allowed for product manipulation including removing prescription requirements, and enabled the creation of discount coupons. The vulnerability, reported to India’s Computer Emergency Response Team in August 2025, was patched in September 2025, but confirmation to CERT-IN was delayed.

Prompt Injection Standardization: Text Techniques vs Intent

www.lasso.security · 5 months ago

Researchers have developed a framework to classify prompt injection attacks against large language models. Prompt injection exploits LLMs by bypassing safety controls and extracting information, with attackers often using subtle techniques like role-playing or encoding. Two primary attacker goals are system prompt leakage, which reveals hidden instructions, and jailbreaking, which circumvents safety restrictions. The framework categorizes attack techniques as psychological manipulation, obfuscation, payload splitting, and instruction smuggling.

Side-Channel Attacks Against LLMs

www.schneier.com · 5 months ago

Researchers have identified several side-channel attacks targeting large language models. One attack exploits timing variations in network traffic to determine conversation topics and potentially recover personal information. Another attack analyzes patterns in speculative decoding processes to fingerprint user queries and even leak confidential data. A third attack, called Whisper Leak, analyzes packet size and timing patterns in encrypted LLM traffic to classify user prompt topics with high accuracy across numerous models. These vulnerabilities highlight a need for improved privacy protections in LLM deployments.

New ‘ClickFix’ Malware Payload Targets Browser Cache, Warns Cybersecurity Experts

gbhackers.com · 5 months ago

Cybersecurity experts are warning of a new malware delivery technique called "ClickFix" that utilizes the browser cache to evade detection. Threat actors are selling a package that allows less technical users to execute social engineering campaigns by hiding malicious code within seemingly harmless image files stored in the browser cache. The process involves tricking the browser into caching a malicious file, then launching a PowerShell script via the File Explorer address bar to extract and run the payload, bypassing traditional network-based detection methods. Security teams are advised to monitor File Explorer usage, browser cache activity, and unusual PowerShell execution.

Poland arrests suspect linked to Phobos ransomware operation

www.bleepingcomputer.com · 5 months ago

Polish police have arrested a 47-year-old man suspected of involvement with the Phobos ransomware group. The arrest is part of "Operation Aether," an international effort coordinated by Europol to disrupt Phobos infrastructure and affiliates. Investigators seized computers and mobile phones containing stolen credentials, credit card numbers, and server access data, and determined the suspect communicated with the cybercrime organization using encrypted messaging apps. Phobos is a ransomware-as-a-service operation linked to breaches at over 1,000 entities worldwide and ransom payments exceeding $16 million.

My Day Getting My Hands Dirty with an NDR System

thehackernews.com · 5 months ago

false

ETH Zurich Breaks “Zero Knowledge” Encryption in Bitwarden, LastPass, and Dashlane

threatroad.substack.com · 5 months ago

Researchers at ETH Zurich have discovered significant vulnerabilities in popular password managers, including Bitwarden, LastPass, and Dashlane, demonstrating that their advertised “zero knowledge” encryption is ineffective when servers are compromised. The study identified numerous attacks, ranging from key swapping to data manipulation, allowing complete password recovery. These vulnerabilities stem from a design flaw where systems assume server trustworthiness, leaving them susceptible to malicious server behavior. While vendors are addressing the issues with patches, fixing the underlying problems requires potentially disruptive changes to existing systems.

3 Threat Groups Started Targeting ICS/OT in 2025: Dragos

www.securityweek.com · 5 months ago

Cybersecurity firm Dragos has identified three new threat groups targeting industrial control systems and operational technology in 2025. Sylvanite acts as a broker, enabling Voltzite to access critical infrastructure, exploiting vulnerabilities like those in Ivanti VPN within 48 hours. Azurite, linked to China, is stealing operational information from organizations across multiple sectors, compromising edge devices to pivot to OT networks. Pyroxene, associated with Iran, uses social engineering and wipers, targeting sectors like aerospace and utilities and positioning for future disruption. Additionally, the Russia-linked Kamacite group is expanding its targeting beyond Ukraine, scanning for industrial devices in the US.

EU Parliament Suspends AI Integration on Corporate Devices Over Cybersecurity Fears

gbhackers.com · 5 months ago

The European Parliament has temporarily disabled built-in artificial intelligence features on employee devices due to cybersecurity and data protection concerns. An internal assessment revealed risks associated with AI tools that transmit data to external cloud services. Affected features include writing assistants, virtual assistants, and webpage summary tools, while standard productivity applications remain operational. This action reflects broader EU concerns regarding data security and foreign technology vendors, following previous bans like the one on TikTok.

New Sophisticated ‘Carding-as-a-Service’ Marketplaces Fuel Surge in Credit Card Fraud

gbhackers.com · 5 months ago

Credit card fraud has evolved into a carding-as-a-service economy with underground marketplaces like Findsome, UltimateShop, and Brian’s Club facilitating the trade of stolen payment data. These platforms offer card numbers, account information, and other personal details, enabling fraud and identity theft. The marketplaces accept Bitcoin and other cryptocurrencies, and have seen increased activity during peak shopping seasons like Black Friday and Cyber Monday. Visa cards are the most frequently leaked, and victims are primarily located in the United States, Canada, and the United Kingdom.

Ireland now also investigating X over Grok-made sexual images

www.bleepingcomputer.com · 5 months ago

Irish data protection authorities have launched a formal investigation into X regarding the use of its Grok artificial intelligence tool. The investigation focuses on whether X complied with data protection regulations, specifically concerning the generation of non-consensual sexual images, including images of children. This inquiry joins similar investigations by the UK Information Commissioner's Office, the European Commission, and others. The Irish investigation carries significant weight due to Ireland being X's European headquarters and the potential for substantial fines across the EU.

Did That Bald Head Get Your Attention? One Start-Up Hopes So.

www.nytimes.com · 5 months ago

false

With Niche Tech World References, Vibe Hopes Its Billboards Reach Start-Up Insiders

www.nytimes.com · 5 months ago

false

With CISOs stretched thin, re-envisioning enterprise risk may be the only fix

www.csoonline.com · 5 months ago

false

Why 2025’s agentic AI boom is a CISO’s worst nightmare

www.csoonline.com · 5 months ago

The shift to agentic AI by late 2025 is transforming enterprise security, though it introduces new risks. Standard RAG systems are failing at a high rate, prompting a move to agentic RAG to improve reliability, but this creates opportunities for malicious exploitation. New vulnerabilities include indirect prompt injection, memory poisoning, and agentic denial-of-service attacks, potentially leading to data exfiltration and financial loss. Exploits like the EchoLeak vulnerability, CVE-2025-32711, have already been observed, highlighting the need for robust defense strategies like guardian agents and diverse system architectures.

DigitStealer Infostealer Targets macOS, Revealing Critical Infrastructure Vulnerabilities

gbhackers.com · 5 months ago

DigitStealer is a macOS infostealer delivered through spoofed applications and fake websites. The malware harvests browser data, keychain contents, cryptocurrency wallets, and system credentials, prioritizing Apple Silicon systems. Its command-and-control infrastructure uses predictable API paths and a cryptographic challenge for authentication, making it trackable. Analysis reveals the operators use a limited set of hosting providers, domain names, and software versions, suggesting a small, tightly controlled operation rather than a widespread malware-as-a-service. Security teams can use this uniformity to identify and enumerate related infrastructure.

Microsoft Finds “Summarize with AI” Prompts Manipulating Chatbot Recommendations

thehackernews.com · 5 months ago

Microsoft researchers have discovered a technique called AI Recommendation Poisoning where businesses are manipulating AI chatbot responses to promote their services. This involves embedding hidden instructions within "Summarize with AI" buttons on websites, which then inject prompts into the AI’s memory to prioritize specific sources. Over 50 unique prompts from 31 companies across various industries have been identified, raising concerns about bias and eroding trust in AI recommendations. Users are advised to be cautious of AI links, audit assistant memory, and avoid clicking buttons from untrusted sources.

Password Managers Vulnerable to Vault Compromise Under Malicious Server

www.securityweek.com · 5 months ago

Security researchers from ETH Zurich have identified vulnerabilities in several popular password managers, including Bitwarden, Dashlane, LastPass, and 1Password. The research focuses on scenarios where a password manager's servers are compromised, targeting account recovery, single sign-on login, and shared vault features. Attackers could potentially view and modify user credentials, leading to full vault compromise. While vendors acknowledge the findings and are implementing fixes, some issues are difficult to resolve due to design limitations inherent in shared features and server-mediated encryption.

Firefox v147.0.3 Released with Critical Fix for Heap Buffer Overflow Vulnerability

gbhackers.com · 5 months ago

Mozilla has released an emergency update for Firefox to address a critical security vulnerability. The flaw, CVE-2026-2447, is a heap buffer overflow in the libvpx video codec library and could allow attackers to execute code or crash the browser. Versions 147.0.4, 140.7.1, and 115.32.1 are now available and users are strongly advised to update immediately. The vulnerability poses a high security risk and impacts Windows, macOS, and Linux systems.

Microsoft Teams Leverages AI Workflows with Microsoft 365 Copilot for Task Automation

gbhackers.com · 5 months ago

false

Malicious Fork of Legitimate Triton App Discovered on GitHub, Exposing New Malware Threat

gbhackers.com · 5 months ago

Attackers have created a malicious fork of a legitimate macOS application called Triton to distribute Windows malware. The forked repository on GitHub uses misleading content and obscured asset paths to trick users into downloading a trojanized ZIP file named Software3.1.zip. The malware uses several techniques to avoid detection, including debugger detection and anti-sandbox measures, and communicates with command and control servers using traffic that blends in with legitimate Office and blockchain services. The file hash associated with the malicious payload is 39b29c38c03868854fb972e7b18f22c2c76520cfb6edf46ba5a5618f74943eac. The malware employs MITRE ATT&CK tactics including Execution, Defense Evasion, Discovery, and Command and Control.

Apache NiFi Vulnerabilities Expose Systems to Authorization Bypass Attacks

gbhackers.com · 5 months ago

Apache NiFi users are being advised to upgrade due to a high-severity authorization flaw. This flaw, identified as CVE-2026-25903, allows less-privileged users to modify configurations of restricted components, potentially undermining security controls. The vulnerability impacts versions 1.1.0 through 2.7.2 and stems from a missing authorization check during component updates. Upgrading to version 2.8.0 resolves the issue, and users should also review access policies and audit component property changes.

Malicious Chrome Extension Exposes Facebook Business Manager Accounts to 2FA and Analytics Theft

gbhackers.com · 5 months ago

A malicious Chrome extension called CL Suite by @CLMasters is stealing sensitive data from Facebook Business Manager accounts. The extension, identified by the ID jkphinfhmfkckkcnifhjiplhfoiefffl, deceptively promises productivity features but secretly harvests Two-Factor Authentication seeds, one-time codes, and business analytics, sending this information to a command-and-control server. This allows attackers to bypass 2FA and potentially take over accounts, as the stolen seeds can generate valid login codes even after the extension is uninstalled. Users should immediately uninstall the extension, revoke sessions, and rotate their 2FA secrets.

QR Codes Exploited for Phishing Attacks and Malware Spread on Mobile Devices

gbhackers.com · 5 months ago

Cybercriminals are increasingly exploiting QR codes to launch phishing attacks and distribute malware on mobile devices. Attackers are embedding QR codes in emails, documents, and websites to bypass security filters and redirect users to malicious sites, often using URL shorteners to disguise the final destination. QR codes are also being used to distribute Android applications directly, bypassing app store security checks, and to trigger in-app account takeovers through deep links, with Russia-aligned actors exploiting Signal’s “linked devices” feature. Security professionals recommend user education, improved technical controls, and monitoring of non-store app installations to mitigate these risks.

Apple Tests End-to-End Encrypted RCS Messaging in iOS 26.4 Developer Beta

thehackernews.com · 5 months ago

false

0APT Ransomware Group Claims 200 Victims, Fails to Provide Proof

gbhackers.com · 5 months ago

A new ransomware-as-a-service group, 0APT, has emerged claiming to have compromised around 200 victims, but has failed to provide verifiable proof of these breaches. The group’s dark web data leak site lists numerous organizations but downloads consistently fail, suggesting fabricated data. Security researchers suspect 0APT is attempting to attract affiliates and deceive victims with a deceptive facade, potentially using elements from AI-generated code, including the Speck cipher. Security teams should cautiously validate claims and investigate any organizations named on the site.

Langchain Community SSRF Bypass Vulnerability Exposes Internal Services to Unauthorized Access

gbhackers.com · 5 months ago

A security vulnerability has been identified in the Langchain community package, specifically within the RecursiveUrlLoader class. This Server-Side Request Forgery bypass, tracked as CVE-2026-26019, allowed attackers to access internal services and cloud metadata due to insufficient URL origin validation. The flaw involved a faulty string comparison method that could be exploited to bypass domain restrictions. The vulnerability has been resolved in version 1.1.14 with stricter origin checks and a new SSRF validation module that blocks connections to private IP addresses and cloud metadata endpoints.

Threat Actors Target OpenClaw Configurations to Steal Login Credentials

gbhackers.com · 5 months ago

Security researchers have observed infostealer malware targeting OpenClaw, an AI assistant platform, to steal sensitive configuration files. Attackers are exfiltrating files like openclaw.json, which contains authentication tokens, device.json, holding cryptographic keys, and soul.md, revealing personal behavioral data. This allows for potential account takeover, device spoofing, and a deep understanding of a user's digital life, representing a new form of AI identity theft. Experts predict the emergence of specialized malware designed to target AI configurations as these platforms become increasingly integral to daily workflows.

Last Week in Security (LWiS) - 2026-02-16

blog.badsectorlabs.com · 5 months ago

Several cybersecurity vulnerabilities and trends were highlighted recently. New York is considering legislation to require firearms detection algorithms for 3D printers, raising concerns about practicality and overreach. Apple addressed a critical vulnerability in iOS and iPadOS, CVE-2025-14174 and CVE-2025-43529, potentially allowing arbitrary code execution, and Google’s Threat Analysis Group reportedly found an exploit chain used against targeted individuals. Researchers detailed techniques involving malicious LNK files, hidden Unicode instructions, and a file write vulnerability in an AMD driver, CVE-2025-61969, enabling local privilege escalation. Numerous tools were also released, including those for generating deceptive LNK files, detecting Unicode characters, and creating Cobalt Strike beacons.

25 Vulnerabilities Found in Cloud Password Managers, Exposing Users to Unauthorized Access and Changes

gbhackers.com · 5 months ago

Researchers have discovered 25 vulnerabilities in three major cloud password managers, potentially exposing users to unauthorized access and data modification. The vulnerabilities, found in Bitwarden, LastPass, and Dashlane, challenge the industry’s “zero-knowledge” encryption claims. These flaws arise from the complexity of code and reliance on older cryptographic technologies, enabling attackers to bypass security protections with common browser actions. Security experts advise users to select password managers with external audits and suggest vendors modernize their systems.

Exploit available for new Chrome zero-day vulnerability, says Google

www.csoonline.com · 5 months ago

A critical zero-day vulnerability has been identified in Google Chrome, allowing attackers to potentially execute code within a user's browser. The vulnerability, tracked as CVE-2026-2441, stems from a use after free memory issue in the browser’s CSS engine. Google has released a patch, but an exploit for this vulnerability is already circulating, and details about the flaw are being limited until more users are updated. IT administrators are urged to apply the patch promptly to protect Windows, Mac, and Linux systems.

Almost Impossible: Java Deserialization Through Broken Crypto in OpenText Directory Services

slcyber.io · 5 months ago

There is a vulnerability in OpenText Directory Services that enables unsafe Java deserialization from a cookie in default configurations without authentication by calling readObject on decompressed cookie data. The weakness comes from a broken signing and parsing scheme where attacker-controlled two byte length fields let an adversary expand the IV and shrink the message so the HMAC over IV concatenated with the compressed message still validates, allowing a ysoserial payload to be positioned at the start of the deserialisation stream. Exploitation required overcoming modified UTF-8 character restrictions and compression behavior by shrinking ysoserial payloads and using an ASCII-compatible Deflate approach so the payload survives nested compression, and successful exploitation can yield remote code execution and compromise authentication across integrated OpenText applications.

Washington Hotel in Japan discloses ransomware infection incident

www.bleepingcomputer.com · 5 months ago

A ransomware attack compromised servers at Washington Hotel in Japan, impacting business data. The incident occurred on February 13, 2026, and prompted the company to engage cybersecurity experts and involve law enforcement. While customer data is reportedly secure, some operational disruptions have been noted, including temporary credit card terminal unavailability. Hackers are exploiting a command injection flaw in Soliton Systems’ FileZen products, identified as CVE-2026-25108, which is used by Japanese companies.

When Audits Fail Part 2: From Pre-Auth SSRF to RCE in TRUfusion Enterprise

www.rcesecurity.com · 5 months ago

Researchers have identified vulnerabilities in Rocket Software’s TRUfusion Enterprise data exchange platform that allow unauthenticated attackers to potentially compromise the system. A server-side request forgery vulnerability, CVE-2025-32355, permits attackers to use the platform as an open forward proxy. This SSRF, combined with a path traversal vulnerability in the WsPortalV6UpDwAxis2Impl service, CVE-2025-59793, and the default password "trubiquity," can lead to pre-authentication remote code execution. The path traversal vulnerability allows attackers to upload files to arbitrary locations on the file system.

nono - kernel-enforced capability sandbox for AI agents

nono.sh · 5 months ago

NULL