Blahalla

Fortinet FortiManager fgtupdates Flaw Enables Attackers to Execute Malicious Commands Remotely

gbhackers.com · 7 months ago

A high-severity vulnerability, tracked as CVE-2025-54820, has been identified in Fortinet’s FortiManager platform, allowing for potential remote command execution. The flaw is a stack-based buffer overflow within the fgtupdates service and impacts specific versions of FortiManager 7.4, 7.2, and 6.4. Organizations are advised to upgrade to secure versions like 7.4.3 or later, 7.2.11 or later, or migrate from version 6.4. As a temporary measure, disabling the fgtupdates service can mitigate the risk.

Five Malicious Rust Crates and AI Bot Exploit CI/CD Pipelines to Steal Developer Secrets

thehackernews.com · 7 months ago

Cybersecurity researchers have identified five malicious Rust crates, chronoanchor, dnp3times, timecalibrator, timecalibrators, and time-sync, that attempted to steal.env files from developer environments. These crates, published to crates.io, impersonated timeapi.io and exfiltrated data to a threat actor-controlled infrastructure. Separately, an AI-powered bot named hackerbot-claw targeted CI/CD pipelines to harvest developer secrets, compromising repositories belonging to Microsoft, Datadog, and Aqua Security. The incident affecting Aqua Security's Trivy extension, versions 1.8.12 and 1.8.13, exploited AI coding assistants to collect and exfiltrate sensitive data and is tracked as CVE-2026-28353. Users are advised to rotate keys, audit CI/CD jobs, and remove affected extensions.

PhantomRaven Malware Resurfaces, Targets npm Supply Chain to Steal Developer Secrets

gbhackers.com · 7 months ago

A large-scale malware campaign called PhantomRaven has resurfaced, targeting the npm software supply chain. Attackers are embedding credential-stealing malware into seemingly legitimate npm packages using a technique called Remote Dynamic Dependencies to evade detection. Security researchers have discovered 88 new malicious packages, with many still accessible in the npm registry and two command-and-control servers remaining operational. The campaign has evolved through multiple waves, including Wave 2, Wave 3, and Wave 4, with changes to infrastructure and package descriptions to avoid detection.

Microsoft SQL Server Zero-Day Exposes Privilege Escalation Risk for Users

gbhackers.com · 7 months ago

Microsoft has disclosed a critical security vulnerability, CVE-2026-21262, affecting SQL Server. This elevation of privilege vulnerability allows attackers with basic network access to gain unauthorized control, with a CVSS score of 8.8. Exploitation requires low complexity and no user interaction, potentially compromising data confidentiality, integrity, and availability. Organizations are urged to apply the Microsoft patch, audit access controls, and monitor network activity to mitigate the risk.

Middle East Conflict Highlights Cloud Resilience Gaps

www.darkreading.com · 7 months ago

Recent military strikes in the Middle East have highlighted vulnerabilities in cloud infrastructure resilience. Attacks on Amazon Web Services facilities in the UAE and Bahrain caused physical damage and disrupted services, demonstrating that cloud data centers are becoming strategic targets. Experts warn that cloud architecture, designed for natural disasters, is not built to withstand kinetic attacks, and that relying solely on high availability is insufficient for true resilience. The incidents may lead governments to reconsider data sovereignty policies and prioritize data backups in allied nations.

6 Mittel gegen Security-Tool-Wildwuchs

www.csoonline.com · 7 months ago

false

Jack & Jill went up the hill — and an AI tried to hack them

www.csoonline.com · 7 months ago

A recent red-team test demonstrated an autonomous AI agent’s ability to exploit vulnerabilities in the Jack & Jill hiring platform. The agent chained together four seemingly minor bugs, a faulty URL fetcher, an open test mode, missing role checks, and lack of domain verification, to gain administrative access and probe the platform's AI defenses. Notably, the agent autonomously generated voice clips to impersonate figures like Donald Trump and engage in social engineering tactics against the platform’s AI voice agents. This experiment highlights the increasing proficiency of AI in identifying and exploiting vulnerabilities, potentially surpassing human capabilities and requiring a new defensive posture for organizations.

Microsoft Patches 83 CVEs in March Update

www.darkreading.com · 7 months ago

Microsoft released security updates for 83 vulnerabilities this month, with six considered likely to be exploited. One vulnerability, CVE-2027-21536, received the highest severity score of 9.8 and is an RCE flaw within the Microsoft Devices Pricing Program. Security experts recommend applying these patches after completing regular testing cycles, noting that the update presents a relatively low risk. Several elevation of privilege vulnerabilities, including CVE-2026-24289, CVE-2026-26132, CVE-2026-24287, CVE-2026-24294, and CVE-2026-23668, were also addressed.

Microsoft Patch Tuesday, March 2026 Edition

krebsonsecurity.com · 7 months ago

Microsoft released security updates to address 77 vulnerabilities across its software, including Windows operating systems. One notable vulnerability, CVE-2026-21262, allows attackers to elevate privileges on SQL Server, potentially granting sysadmin access over a network. Another publicly disclosed flaw, CVE-2026-26127, affects.NET applications, potentially causing denial-of-service crashes. Several privilege escalation vulnerabilities, including CVE-2026-24291, CVE-2026-24294, CVE-2026-24289, and CVE-2026-25187, were also patched, and one critical remote code execution flaw, CVE-2026-21536, was discovered by an AI agent.

SVD-2026-0302: Remote Command Execution (RCE) through the '/splunkd/__upload/indexing/preview' REST endpoint in Splunk Enterprise