Blahalla

Cyberspy Group Hacked Governments and Critical Infrastructure in 37 Countries

www.securityweek.com · 5 months ago

A state-sponsored cyberespionage group, tracked as TGR-STA-1030 and known as the Shadow Campaign, has targeted government and critical infrastructure organizations in dozens of countries. The group, believed to be operating out of Asia, has compromised the systems of at least 70 organizations and conducted reconnaissance in 155 countries, targeting areas such as law enforcement and finance. Attackers initially gain access through sophisticated phishing emails and use a previously unknown Linux kernel rootkit called ShadowGuard to remain undetected. They have attempted to exploit known vulnerabilities in products from Microsoft, SAP, Atlassian, D-Link, Apache, Commvault, and various China-based vendors.

Infy Hackers Resume Operations with New C2 Servers After Iran Internet Blackout Ends

thehackernews.com · 5 months ago

Iranian threat group Infy, also known as Prince of Persia, has resumed operations after a period of inactivity linked to recent internet restrictions. The group has updated its command-and-control infrastructure, utilizing new domain generation algorithms and blockchain data de-obfuscation. Researchers have observed the use of Tornado version 51, which employs both HTTP and Telegram for communication, and a one-day exploit for CVE-2025-8088 and CVE-2025-6218 in WinRAR. Analysis reveals a connection to ZZ Stealer and a possible link to Charming Kitten.

Zendesk spam wave returns, floods users with 'Activate account' emails

www.bleepingcomputer.com · 5 months ago

A new wave of spam emails is affecting users globally, with recipients reporting hundreds of messages with subject lines like "Activate your account." The emails appear to originate from companies' Zendesk support systems, bypassing spam filters and directly entering inboxes. This activity mirrors a similar incident in January, where attackers exploited Zendesk ticket submission forms for spam relay purposes. Zendesk has previously implemented safety features, but attackers may still be finding ways to abuse exposed ticket portals.

DragonForce Ransomware Targets Critical Businesses to Exfiltrate Sensitive Data

gbhackers.com · 5 months ago

DragonForce is a rapidly evolving ransomware group that emerged in late 2023, combining data theft with file encryption using a dual extortion strategy. The group operates as a ransomware-as-a-service platform, enabling affiliates to target Windows, Linux, ESXi, BSD, and NAS systems with automated encryption and delayed-start options. DragonForce has professionalized its operations by offering services like data audits and allowing affiliates to create their own brands under a shared infrastructure. Security experts recommend hunting for pre-ransomware activity, enforcing multi-factor authentication, maintaining strong patch management, and ensuring reliable backups.

Microsoft develops a new scanner to detect hidden backdoors in LLMs

www.csoonline.com · 5 months ago

Microsoft has developed a new scanner to detect hidden backdoors in open-weight AI language models. These backdoors can be embedded during training and activated by specific inputs, potentially leading to data exposure or malicious activity. The scanner identifies telltale “signatures” such as unusual attention patterns, data leakage, and reactions to partial trigger strings. Microsoft says the scanner operates efficiently and works with many common language models, though analysts caution that attackers will likely adapt to circumvent it.

Building trust with the board through evidence-based proof

www.csoonline.com · 5 months ago

false

Cisco, F5 Patch High-Severity Vulnerabilities

www.securityweek.com · 5 months ago

Cisco and F5 have released security updates to address multiple vulnerabilities. Cisco patches resolve five security defects, including two high-severity issues, CVE-2026-20119, which causes denial-of-service, and CVE-2026-20098, which enables command execution with root privileges. F5’s updates address five vulnerabilities, with CVE-2026-22548 potentially causing denial-of-service and CVE-2026-1642 allowing for man-in-the-middle attacks. Neither company has evidence of these flaws being exploited.

Go 1.25.7 and Go 1.24.13 Released With Patches for Multiple Security Vulnerabilities

gbhackers.com · 5 months ago

New versions of Go, 1.25.7 and 1.24.13, have been released to address security vulnerabilities. One vulnerability, CVE-2025-61732, affects the cmd/cgo tool and allows for code smuggling due to differences in comment parsing between Go and C/C++ compilers. Another vulnerability, CVE-2025-68121, concerns the crypto/tls package and involves a potential authentication bypass during session resumption. Users are strongly encouraged to update their Go installations to mitigate these risks.

New CentOS UAF to LPE vulnerability

ssd-disclosure.com · 5 months ago

A local user can exploit a use after free vulnerability in the Linux Kernel's networking scheduler CAKE Qdisc to achieve root privilege escalation. The flaw is triggered by how the CAKE Qdisc enqueue function improperly reports success even when it drops a network packet. This specific vulnerability arises when an HFSC Qdisc is layered over a CAKE Qdisc, as the removal process leaves a dangling pointer by failing to eliminate the class from the active list. Vendor remediation is currently in progress with no release date provided.

Weaponized Voicemail Hack Allows Remote Access to Systems, Experts Warn

gbhackers.com · 5 months ago

Attackers are using fake voicemail notifications to trick victims into installing a remote management tool, granting them persistent system access. The scheme involves compromised websites displaying convincing voicemail landing pages, which prompt users to download a batch file disguised as an audio update. This file installs Remotely RMM, enrolling systems into an attacker-controlled environment, allowing for actions like data theft and ransomware deployment. Security experts recommend verifying voicemail notifications, disabling batch file execution, and implementing endpoint detection and response solutions. The domains bannerbank[.]cadillac[.]ps, smbk[.]cadillac[.]ps, and others are associated with the campaign.

Kurz vor Olympia: Italien wehrt russische Hacker-Angriffe ab

www.csoonline.com · 5 months ago

Italian authorities have successfully defended against several cyberattacks believed to originate from Russia, occurring just before the Winter Olympics in Milan and Cortina d’Ampezzo. The attacks targeted locations including hotels in Cortina and facilities within the Foreign Ministry. Officials state that cybersecurity is now a key factor, and all relevant agencies were notified. Preparations for cybersecurity have been underway for some time, involving local experts and Olympic organizers.

APT28 Hackers Exploit Microsoft Office Vulnerability to Target Government Agencies

gbhackers.com · 5 months ago

Russian state-sponsored hackers, known as APT28 or Fancy Bear, are targeting government and military organizations across Europe in a new cyberattack campaign. The attackers are exploiting a newly discovered Microsoft Office vulnerability, CVE-2026-21509, to install malware without requiring user interaction. They use spear-phishing emails disguised as official communications, employing tools like "BeardShell" and a backdoor called "NotDoor" to steal information and monitor email communications. Organizations are urged to update Microsoft Office to patch the vulnerability and monitor network traffic.

Amaranth-Dragon Exploits WinRAR Vulnerability for Persistent Access to Victim Systems

gbhackers.com · 5 months ago

A cyber-espionage group, Amaranth-Dragon, linked to APT-41, is targeting government and law enforcement agencies in Southeast Asia. They exploit vulnerabilities, such as CVE-2025-8088, a path traversal flaw in WinRAR, to gain persistent access to victim systems by dropping malicious scripts into the Windows Startup folder. The group utilizes custom tools like Amaranth Loader and Havoc C2 Framework, along with Cloudflare geofencing, to remain undetected and manage infected devices remotely. A new remote access trojan, TGAmaranth RAT, employs Telegram bots to disguise malicious traffic and evade security defenses.

Protests Don't Impede Iranian Spying on Expats, Syrians, Israelis

www.darkreading.com · 5 months ago

Iranian attackers are conducting spear-phishing campaigns targeting Iranian activists, Syrian opposition figures, Israeli officials, and Americans abroad. The campaigns use tactics such as malicious WhatsApp links redirecting to fake login pages and impersonating individuals on X to solicit fake Google Meet interviews. Attackers aim to steal credentials and gain control of devices, potentially accessing sensitive information like location data, audio, and photos. While the techniques appear less sophisticated than previously observed Iranian APT activity, the attacks are widespread and affect a diverse range of targets.

Software supply chain risks join the OWASP top 10 list, access control still on top

www.csoonline.com · 5 months ago

The Open Worldwide Application Security Project has updated its Top 10 list of web application vulnerabilities. Broken access control remains the top concern, while software supply chain failures is a new addition, reflecting increased attacks targeting developers and the software development lifecycle. Security misconfiguration moved to the second spot, and mishandling of exceptional conditions rounds out the list. The list also highlights the emerging risk of inappropriate trust in AI-generated code, or "vibe coding," and includes X03:2025 as a future concern.

CVE-2025-11730: Remote Code Execution via DDNS configuration in ZYXEL ATP/USG Series (V5.41)

rainpwn.blog · 5 months ago

A critical Remote Code Execution vulnerability, identified as CVE-2025-11730, has been discovered in Zyxel ATP/USG Series routers running firmware version V5.41. The flaw resides in the Dynamic DNS profile configuration, enabling attackers to gain root shell access through crafted URLs. Exploitation allows for file manipulation and the creation of persistent backdoors on the affected routers. Zyxel has acknowledged the vulnerability and plans to release a patch and security advisory on February 5, 2026.

Threat Actors Exploiting NGINX Servers to Redirect Web Traffic to Malicious Sites

gbhackers.com · 5 months ago

Cybercriminals are targeting NGINX servers, particularly those utilizing the Baota management panel, to redirect website traffic to malicious sites. Attackers modify NGINX configuration files, specifically using the proxypass directive, to send users to servers they control, serving fake content like gambling or scam pages. The attackers use a five-stage scripting process, including scripts like zx.sh and bt.sh, to inject malicious code and report on successful hijackings. Security experts recommend regularly reviewing NGINX configuration files to prevent unauthorized modifications.

New DesckVB RAT Unveiled with Multi-Stage Infection Chain and Plugin-Based Architecture

gbhackers.com · 5 months ago

A new version of the DeskVB Remote Access Trojan, version 2.9.0.0, has been identified, exhibiting a modular design and a multi-stage infection process. The malware utilizes a Windows Script Host JavaScript file, PowerShell scripts, and a.NET loader to evade detection and execute its payload, which includes plugins for keylogging, webcam access, and antivirus detection. Communication with the Command and Control server uses a custom TCP protocol with consistent delimiters for potential network-level detection. Analysis revealed shared toolchain linkages through repeated metadata strings like “Pjoao1578”.

Critical n8n Flaw CVE-2026-25049 Enables System Command Execution via Malicious Workflows

thehackernews.com · 5 months ago

A critical security vulnerability, CVE-2026-25049, has been discovered in the n8n workflow automation platform. The flaw allows authenticated users with workflow creation or modification permissions to execute system commands by crafting malicious expressions. This bypasses previous security measures related to CVE-2025-68613, which was patched in December 2025. Successful exploitation could enable attackers to steal credentials, access internal systems, and install backdoors; versions prior to 1.123.17 and 2.5.2 are affected.

WatchGuard VPN Client Flaw on Windows Enables SYSTEM‑Level Command Execution

gbhackers.com · 5 months ago

A critical security vulnerability has been identified in the WatchGuard Mobile VPN with IPSec client for Windows. The flaw, tracked as NCPVE-2025-0626 and WatchGuard Advisory WGSA-2026-00002, allows local attackers to execute commands with SYSTEM-level privileges during installation, update, or uninstallation processes. This occurs because vulnerable versions temporarily run command prompts under the SYSTEM account, enabling privilege escalation. WatchGuard has released version 15.33 to resolve the issue, and immediate patching is required as no workarounds are available.

Cyberattackers Exploit DNS TXT Records in ClickFix Script to Execute Malicious PowerShell Commands

gbhackers.com · 5 months ago

Cybercriminals are employing a new tactic called KongTuke, an evolution of the ClickFix social engineering campaign. This technique uses DNS TXT records to deliver malicious PowerShell commands, bypassing traditional security filters and firewalls. Users are tricked into executing the commands, which retrieve and run a second-stage payload, often an information stealer or downloader. Security experts recommend monitoring PowerShell execution and educating users against running commands pasted from online prompts.

Malicious NGINX Configurations Enable Large-Scale Web Traffic Hijacking Campaign

thehackernews.com · 5 months ago

Security researchers have identified an ongoing web traffic hijacking campaign targeting NGINX installations and Baota panel environments. Attackers use malicious configurations to redirect legitimate web traffic through their servers, focusing on Asian domains, Chinese hosting, and government sites. The campaign utilizes a multi-stage toolkit involving shell scripts to inject configurations and establish persistence. This activity is linked to exploitation of the React2Shell vulnerability, CVE-2025-55182, with a CVSS score of 10.0, and involves hundreds of unique IP addresses.

Cisco Warns of Meeting Management Flaw Enabling Arbitrary File Upload by Remote Attackers

gbhackers.com · 5 months ago

Cisco has identified a high-severity vulnerability in Cisco Meeting Management, allowing authenticated remote attackers to upload files and potentially execute commands with root privileges. The flaw, CVE-2026-20098, arises from improper input validation in the Certificate Management feature and requires a user account with video operator credentials. Versions 3.12 and earlier are affected, and Cisco advises administrators to immediately upgrade to version 3.12.1 MR as no workarounds are available. The vulnerability was reported by the NATO Cyber Security Centre Penetration Testing Team and is not currently known to be exploited.

Microsoft to Integrate Sysmon Threat Detection Natively into Windows 11

gbhackers.com · 5 months ago

false

CISA Confirms VMware ESXi 0-Day Vulnerability Exploited in Ransomware Operations

gbhackers.com · 5 months ago

The Cybersecurity and Infrastructure Security Agency has added a critical vulnerability, CVE-2025-22225, to its Known Exploited Vulnerabilities catalog. This flaw allows attackers to escape security sandboxes within the VMware ESXi hypervisor, enabling unauthorized access to the host system. Ransomware groups are actively exploiting this arbitrary write memory management vulnerability, affecting organizations that use ESXi servers. Federal agencies must patch affected systems by March 25, 2025, and all organizations are urged to prioritize remediation.

1.5 million AI agents are at risk of going rogue

www.csoonline.com · 5 months ago

A recent study indicates that over three million AI agents are currently in use by organizations in the US and UK, with more than half operating without active monitoring or security measures. Experts warn that these “ungoverned” agents pose a significant risk of going rogue, potentially leading to data breaches or other security incidents. Many organizations lack visibility into the number of AI agents they have deployed and their access levels, creating a situation likened to the Titanic disaster, where known risks were ignored. The findings highlight a need for continuous oversight and tiered access controls to manage the growing risks associated with AI agent deployment.

Smashing Security podcast #453: The Epstein Files didn’t hide this hacker very well

grahamcluley.com · 5 months ago

Recently released, redacted files related to Jeffrey Epstein appear to have revealed identifying information despite redaction attempts, potentially leading to reputational damage. A senior US cybersecurity official inadvertently uploaded sensitive government material to a public version of ChatGPT, highlighting an insider threat. Several security incidents occurred, including Notepad++ being hijacked for malware distribution, a pornography-quitting app leaking user data, and an anti-virus update being used to deliver malware. An informant revealed Jeffrey Epstein had a personal hacker, according to documents from the Department of Justice.

Recreating uncensored Epstein PDFs from raw encoded attachments... or trying to, anyway

neosmart.net · 5 months ago

The US Department of Justice released documents related to the Epstein case containing errors such as corrupted files and redaction issues. Some emails included base64 encoded PDF attachments that were missed during the redaction process. Recovering these documents is difficult due to poor optical character recognition quality resulting from the use of the Courier New font and JPEG compression. Researchers are challenging others to attempt reconstructing the original PDF data from the base64 output to further assess the quality of the released information.

Hackers compromise NGINX servers to redirect user traffic

www.bleepingcomputer.com · 5 months ago

Hackers are compromising NGINX servers to redirect user traffic through attacker-controlled infrastructure. The malicious campaign targets websites with specific top-level domains and government or educational sites. Attackers inject malicious code into NGINX configuration files to rewrite URLs and forward traffic, preserving request headers to maintain a semblance of legitimacy. The attack uses a multi-stage toolkit to modify configurations without triggering security alerts or causing service downtime.

France’s Raid on X Escalates Trans-Atlantic Showdown Over Social Media

www.nytimes.com · 5 months ago

false

Ransomware Gang Goes Full 'Godfather' With Cartel

www.darkreading.com · 5 months ago

The ransomware group DragonForce is establishing a cartel within the ransomware ecosystem, offering affiliates resources like storage, server monitoring, and negotiation guidance. This model allows affiliates to operate independently under the DragonForce umbrella while benefiting from shared services and data valuation audits. DragonForce has also engaged in disruptive tactics against rival ransomware groups and proposed cooperation with major players like LockBit and Qilin to standardize operations and increase profits. Their ransomware uses code similar to Conti and targets organizations in several countries, particularly those in manufacturing and technology.

2026: New N8N RCE Deep Dive into CVE-2026-25049

blog.securelayer7.net · 5 months ago

A critical zero-day Remote Code Execution vulnerability, CVE-2026-25049, has been discovered in the n8n workflow automation platform. Attackers can exploit this flaw, affecting versions prior to 1.123.17 and 2.5.2, by injecting malicious JavaScript via a publicly accessible webhook, even without authentication. This vulnerability bypasses multiple security layers and allows attackers to fully compromise the server, steal credentials, and potentially access connected systems. Patches are available in versions 1.123.17 and 2.5.2 and later, and users are advised to upgrade immediately.

Threat actors hijack web traffic after exploiting React2Shell vulnerability: Report

www.csoonline.com · 5 months ago

Threat actors are exploiting the React2Shell vulnerability, identified as CVE-2025-55182, to hijack web traffic and compromise web domains. Attackers are targeting organizations running Nginx web servers managed with Boato Panel, particularly those in Asia. Once inside a network, attackers are redirecting traffic to malicious landing pages, inserting malware, and fingerprinting web traffic. Security experts recommend monitoring configuration file integrity, applying security patches, and tracking Nginx security advisories to defend against these attacks.

Threat actors hijack web traffic after exploiting React2Shell vulnerability

www.csoonline.com · 5 months ago

Threat actors are exploiting the React2Shell vulnerability, CVE-2025-55182, to compromise web servers and redirect traffic. Researchers have observed attackers targeting NGINX servers, particularly those managed with Boato Panel, impacting organizations in Asia and China. These attacks can involve fingerprinting web traffic, distributing malware, and redirecting users to malicious landing pages. Security experts suggest monitoring configuration file integrity and applying security patches to mitigate this escalating threat.

CISA Makes Unpublicized Ransomware Updates to KEV Catalog

www.darkreading.com · 5 months ago

A researcher discovered that the US Cybersecurity and Infrastructure Security Agency, or CISA, has been quietly updating its Known Exploited Vulnerabilities catalog to indicate when vulnerabilities are being used in ransomware attacks. These updates, which change the status from "Unknown" to "Known," are not publicly announced, potentially misleading organizations prioritizing vulnerability mitigation. The affected CVEs include 16 from Microsoft, six from Ivanti, and five from Fortinet, with remote code execution and authentication bypass vulnerabilities being the most common. GreyNoise developed a tool to track these silent changes and alert users to evolving threats.

Julius - Open Source LLM Service Fingerprinting Tool

www.praetorian.com · 5 months ago

false

Critical n8n flaws disclosed along with public exploits

www.bleepingcomputer.com · 5 months ago

Critical vulnerabilities have been identified in the n8n workflow automation platform, enabling attackers to gain complete control of the server. The issues, tracked as CVE-2026-25049, arise from inadequate sandboxing of user-written JavaScript expressions, bypassing previous patches and allowing remote code execution. Exploitation allows access to credentials, sensitive files, and connected systems, potentially impacting other tenants in multi-tenant environments. Users are urged to update to version 1.123.17 or 2.5.2 and rotate server credentials.

Attackers Use Windows Screensavers to Drop Malware, RMM Tools

www.darkreading.com · 5 months ago

Attackers are now using Windows screensaver files, with the.scr extension, in spear phishing campaigns to compromise organizations. These files, often overlooked, are executable programs that can install remote monitoring and management (RMM) tools like JWrapper, granting attackers interactive remote control. The technique involves luring users into downloading and running the screensaver file, bypassing security tools due to the unusual file type. ReliaQuest recommends treating.scr files as executables, maintaining an RMM allowlist, and blocking non-business file-hosting services.

Taiwanese national sentenced to 30 years for running darknet Incognito Market

therecord.media · 5 months ago

A Taiwanese national, Rui-Siang Lin, has been sentenced to 30 years in U.S. prison for operating Incognito Market, a large dark web marketplace for illegal narcotics. Lin, using the online alias “Pharaoh,” facilitated over $105 million in drug sales, including significant quantities of cocaine, methamphetamine, and fentanyl-laced oxycodone. He managed the platform, which had approximately 400,000 customer accounts and 1,800 vendors, earning roughly $6 million in profit. Authorities linked Lin to the site through cryptocurrency wallet registrations and traced his activities, leading to his arrest and subsequent conviction on charges including distributing narcotics and money laundering.

Kernel-Level Stealthy Observation of TTY Streams

blog.cybervelia.com · 5 months ago

A new kernel module monitors TTY connections, such as SSH and console sessions, using a stealthy method that avoids direct system call hooks. The underlying mechanism involves understanding the complex internal data movement within the Linux TTY subsystem. Data flow is managed by the TTY core, which uses line disciplines, acting as pluggable processors between user space and the hardware driver. These line disciplines allow for data modification and interpretation, keeping the high-level behavior separate from the physical hardware interaction.

Microsoft Develops Scanner to Detect Backdoors in Open-Weight Large Language Models

thehackernews.com · 5 months ago

Microsoft has developed a lightweight scanner to detect backdoors in open-weight large language models, aiming to improve trust in artificial intelligence systems. The scanner identifies backdoors by observing three signals: a distinctive attention pattern, data leakage via memorization, and responses to multiple trigger variations. This methodology does not require additional model training and can analyze models at scale, extracting memorized content and formalizing detection as loss functions. Microsoft acknowledges the scanner’s limitations, noting it does not work on proprietary models or detect all backdoor types.

CISA: VMware ESXi flaw now exploited in ransomware attacks

www.bleepingcomputer.com · 5 months ago

CISA confirmed on Wednesday that ransomware gangs have begun exploiting a high-severity VMware ESXi sandbox escape vulnerability that was previously used in zero-day attacks.

DEAD#VAX Malware Campaign Deploys AsyncRAT via IPFS-Hosted VHD Phishing Files

thehackernews.com · 5 months ago

A new malware campaign called DEADVAX is using a sophisticated approach to infect systems with the AsyncRAT trojan. The attack begins with a phishing email containing a Virtual Hard Disk disguised as a PDF. This VHD file hosts malicious Windows Script Files, batch scripts, and PowerShell loaders, which inject AsyncRAT directly into trusted Windows processes, avoiding disk-based artifacts. The trojan offers attackers extensive control over compromised machines, including keylogging, screen capture, and remote command execution.

Detecting backdoored language models at scale

www.microsoft.com · 5 months ago

Researchers have identified key indicators of backdoors in language models, posing a subtle threat beyond traditional malware. These backdoors, introduced during model training, trigger malicious behavior when specific phrases are used. Three observable signatures include a distinctive "double triangle" attention pattern, the model leaking its own training data, and a surprising tolerance for variations of the trigger phrase. Microsoft has developed a practical scanner to detect these backdoors without requiring model retraining, focusing on identifying likely triggers and operating efficiently across various language models.

Exclusive: US used cyber weapons to disrupt Iranian air defenses during 2025 strikes

therecord.media · 5 months ago

The U.S. military digitally disrupted Iranian air missile defense systems during its operation last year against the country’s nuclear program, some of the most sophisticated action Cyber Command has taken to date against Iran.

Cisco Prime Infrastructure Stored Cross-Site Scripting Vulnerability

sec.cloudapps.cisco.com · 5 months ago

A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against users of the interface of an affected system. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by inserting malicious code into specific data fields in the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, an attacker must have valid administrative credentials. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pi-xss-bYeVKCD <br/Security Impact Rating: Medium <br/CVE: CVE-2026-20111

Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Open Redirect Vulnerability

sec.cloudapps.cisco.com · 5 months ago

A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of the parameters in the HTTP request. An attacker could exploit this vulnerability by intercepting and modifying an HTTP request from a user. A successful exploit could allow the attacker to redirect the user to a malicious web page. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-epnm-pi-redirect-6sX82dN <br/Security Impact Rating: Medium <br/CVE: CVE-2026-20123

Cisco Meeting Management Arbitrary File Upload Vulnerability

sec.cloudapps.cisco.com · 5 months ago

A vulnerability in the Certificate Management feature of Cisco Meeting Management could allow an authenticated, remote attacker to upload arbitrary files, execute arbitrary commands, and elevate privileges to root on an affected system. This vulnerability is due to improper input validation in certain sections of the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to upload arbitrary files to the affected system. The malicious files could overwrite system files that are processed by the root system account and allow arbitrary command execution with root privileges. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of video operator. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cmm-file-up-kY47n8kK <br/Security Impact Rating: High <br/CVE: CVE-2026-20098

MomentProof Deploys Patented Digital Asset Protection

gbhackers.com · 5 months ago

false

Ukraine tightens controls on Starlink terminals to counter Russian drones

therecord.media · 5 months ago

Ukraine has rolled out a verification system for Starlink satellite internet terminals used by civilians and the military after confirming that Russian forces have begun installing the technology on attack drones.