Espionage groups use the BlueMoon exploit kit in new attacks. Discover how BlueMoon exploit kit campaigns exploit Chrome zero-days.
Related Posts:
Trojanized Fake macOS Installers Spread OtterCookie Backdoor
Microsoft 365 RejectDirectSend Bypass Lets Attackers Spoof Internal Emails
Attackers Use AI Tools to Hit Latin American Orgs
The post BlueMoon Exploit Kit Chains Chrome and Windows Zero-Days appeared first on Daily CyberSecurity.
Chrome's two-week release cycle begins with Chrome 153, doubling the pace of features and security patches while Extended Stable stays at 8 weeks.
Related Posts:
Google Overhauls European Search Engine Results
Meta Launches Muse: A Personal AI Agent That Acts on Your Behalf
OpenAI Launches ChatGPT Images 2.5 with 50% Lower Latency and Precision Editing
The post Chrome Moves to a Two-Week Release Cycle Starting with Chrome 153 appeared first on Daily CyberSecurity.
StyleSmuggler Magento zero-day is under active attack, letting unauthenticated attackers execute code and install backdoors on stores that may already be patched.
A new zero-day flaw, dubbed StyleSmuggler, in Magento and Adobe Commerce is under active attack, giving unauthenticated attackers a path to run code on vulnerable online stores. Sansec researchers say it affects current Magento Open Source releases, including 2.4.7, 2.4.8 and 2.4.9. According to the experts, exploitation began on S
StyleSmuggler Magento zero-day is under active attack, letting unauthenticated attackers execute code and install backdoors on stores that may already be patched.
A new zero-day flaw, dubbed StyleSmuggler, in Magento and Adobe Commerce is under active attack, giving unauthenticated attackers a path to run code on vulnerable online stores. Sansec researchers say it affects current Magento Open Source releases, including 2.4.7, 2.4.8 and 2.4.9. According to the experts, exploitation began on September 4.
“Sansec discovered StyleSmuggler, an unpatched Magento and Adobe Commerce zero-day that gives unauthenticated attackers remote code execution. All current versions are affected, including 2.4.9.” reads the report published by Sansec. “Attacks started September 4th. Sansec is rolling out emergency mitigation.”
This is not a routine patch-cycle problem. Sansec reproduced the full attack chain on clean installations and observed a first victim running Magento 2.4.6-p15 with July and August 2026 patches already applied and a clean patch-status result. In plain terms, a store could be fully updated according to its normal process and still be exposed.
“StyleSmuggler injects malicious code into Magento’s template system.” states Sansec. “By using the styles properties, it can evade existing safeguards. It works in two stages:
Inject (poison) PHP code, for example by generating a failure report.
Let Magento execute the poisoned code via a failed payment email“
The attack is especially dangerous because it does not require a victim to open an attachment, click a link or even receive a successful email. Magento can execute the injected code while it renders its standard “Payment Transaction Failed Reminder” notification, and the chain can still work if email delivery itself fails.
That makes unusual spikes in failed-payment reminders a useful detection clue, although not conclusive proof of compromise. Legitimate payment failures happen. A sudden burst of them combined with strange system activity is a different conversation.
StyleSmuggler works by placing PHP code into Magento’s templating path and later causing the platform to evaluate it. The first stage creates or poisons a record, while the second stage turns a routine email-rendering process into remote code execution.
The attack reportedly uses GraphQL-related handling and the styles property to evade safeguards that would normally reject dangerous input. Sansec says moving sessions to Redis or a database does not stop the attack, because operators have already adapted their methods when one delivery route fails.
“Moving sessions to Redis or the database does not stop the attack. One merchant reported an attempt that failed against session storage and, eight seconds later, a second attempt that succeeded by using a file uploaded through Magento’s custom options instead.” continues the report. “Both came from the same operator.”
That detail matters because it shows an active operator, not a static proof-of-concept circulating online. Defenders should assume attackers are testing several paths, watching failures and changing tactics quickly.
Once the exploit succeeds, Sansec observed a lightweight Rust backdoor that connects to attacker-controlled infrastructure and waits for commands. At the time of the report, Sansec had not seen evidence that operators had yet used the implant for follow-on actions, but a backdoor that is installed and waiting is not an idle technical curiosity.
The malware initially hid behind a process name resembling [kworker/u:8:0], then appeared as fc-cache on September 6 and as chronyd on September 7.
These names are designed to blend into Linux environments, where administrators may expect to see kernel workers, font-cache utilities and Network Time Protocol daemons.
The fc-cache variant copies itself into a font-cache directory, writes a PID lock file and uses cron to restart twice an hour. The chronyd version can persist through cron as well, but Sansec also observed a build that relaunched itself without relying on a visible cron entry. An empty crontab is not proof that a host is clean.
The command channel is disguised as time synchronisation traffic. The implant sends 48-byte UDP packets to port 123, the standard NTP port, and uses domains that resemble time servers.
“Command and control is disguised as time sync. Every 60 seconds it resolves ntp.timesync.to and sends 48-byte UDP packets to port 123 that look like NTP server replies.” continues the report.
Only the first four bytes look like a normal NTP message; the remaining data can carry the agent ID, hostname, username, operating-system version, memory and disk use, uptime, root status and implant version.
That is a smart concealment choice. Many networks allow NTP traffic without close inspection because reliable time synchronisation is a normal operational requirement. Calling your malware chronyd and making it speak something that resembles NTP is not subtle genius. It is just clever enough to pass a lazy allowlist.
Sansec also found signs of a second, apparently unrelated attacker operating against stores compromised through StyleSmuggler. This actor deployed a compact PHP dropper that placed a web shell inside the product-image cache, using hash-like directory names to make the extra PHP file less obvious.
The web shell returns a normal-looking 404 response unless a request contains the correct X-Cache-Token header. With the header present, it can execute PHP supplied through a POST parameter. That design helps the attacker keep the shell invisible during casual checks and automated scans.
“Before writing that file, the dropper calls out to 457cfa2fb7p5.daf892t5qau4og8pi4cghbc6fhm1dim3u.oast.site, a subdomain of a public service that developers and testers use to confirm that injected code ran.” states the report. “This actor came in through StyleSmuggler. We recovered the dropper from a Store: request header, and its PHP tags are still JSON-escaped from the record Magento logged it into.”
The lesson is not merely to remove the obvious background process. Stores need a full compromise assessment, including a review of PHP files under pub/media, cron spool files, unexpected processes, altered templates, report records, web-server logs and outbound connections.
Adobe was working on a patch as of September 7, according to Sansec, but no release date had been confirmed. A scheduled Adobe security release was due on September 8, although it was not known whether it would address StyleSmuggler.
Until an official fix is available and applied, merchants should consider temporarily disabling GraphQL if they do not have a compensating control capable of blocking this exploit. This can affect storefront and integration functions, so it should be treated as a risk decision rather than a casual configuration change.
Operators should also hunt for processes named [kworker/u:8:0], fc-cache and chronyd that run from unusual paths such as temporary directories, user cache directories or hidden folders. A legitimate chronyd process does not normally emit nine NTP server-mode packets in rapid succession every minute.
Security teams should inspect outbound traffic to suspicious NTP-like domains and UDP port 123 destinations, particularly 185.157.160.251, which Sansec linked to the observed domains on September 7. They should also search authentication and system logs for repeated crontab command not allowed messages generated by the web-service user, such as www-data.
If compromise indicators appear, treat the system as compromised, not merely vulnerable. Isolate the host, preserve logs and forensic evidence, rotate Magento administrator credentials, API tokens, database credentials, payment-provider secrets and cloud keys, then search for secondary backdoors before restoring normal operations.
The Sansec StyleSmuggler report includes current indicators of compromise, malware hashes, C2 infrastructure, suspicious process names and file paths. Its guidance will likely change as the campaign develops, because the attackers have already changed payload names and persistence methods within days.
A newly published proof-of-concept (PoC) called ShieldCrash reveals an unpatched vulnerability in Microsoft Defender that allows a local attacker to gain arbitrary file-read access in the SYSTEM context. This disclosure, attributed to the researcher known as MSNightmare, comes shortly after Microsoft addressed an elevation-of-privilege flaw in the Microsoft Malware Protection Engine, tracked as CVE-2026-69414, referred […]
The post Windows Defender ShieldCrash 0-Day Lets Attackers Read Arbitrary
A newly published proof-of-concept (PoC) called ShieldCrash reveals an unpatched vulnerability in Microsoft Defender that allows a local attacker to gain arbitrary file-read access in the SYSTEM context. This disclosure, attributed to the researcher known as MSNightmare, comes shortly after Microsoft addressed an elevation-of-privilege flaw in the Microsoft Malware Protection Engine, tracked as CVE-2026-69414, referred […]
The N-able N-central vulnerability CVE-2026-86218 is a CVSS 10 pre-auth RCE reported exploited in the wild. Apply 2026.3 HF4 immediately.
Related Posts:
MikroTrick PoC: RouterOS Admin Rights Exploited In Wild
AI Agent Coordination: The Unprecedented OpenAI Breakout
Roundcube Security Update Fixes 12 Webmail Flaws
The post CVE-2026-86218 (CVSS 10): N-central Pre-Auth RCE Exploited in the Wild appeared first on Daily CyberSecurity.
StyleSmuggler, a Magento zero-day, gives unauthenticated remote code execution and is exploited in the wild. No patch yet. Mitigate now.
Related Posts:
CVE-2026-86218 (CVSS 10): N-central Pre-Auth RCE Exploited in the Wild
MikroTrick PoC: RouterOS Admin Rights Exploited In Wild
AI Agent Coordination: The Unprecedented OpenAI Breakout
The post StyleSmuggler: Magento Zero-Day RCE Exploited in the Wild appeared first on Daily CyberSecurity.
Google patched a Chrome zero-day vulnerability currently exploited in the wild. The update resolves a severe V8 type confusion flaw (CVE-2026-85046).
Related Posts:
CVE-2026-75754 (CVSS 10): ASUS Control Center Root RCE
Apache Allura Security Vulnerabilities Patched in v1.21.0
CVE-2026-52924 PoC Exploit Disclosed: 9.8 CVSS Linux Root Privilege Escalation
The post CVE-2026-85046: Chrome Zero-Day Vulnerability Exploited in the Wild appeared first on Daily CyberSecurity.
Google patched 12 Chrome flaws, including an actively exploited V8 zero-day that could enable remote code execution through a crafted webpage.
Google released a Chrome security update fixing 12 vulnerabilities, including CVE-2026-85046 (CVSS score of 8.8), an actively exploited V8 type confusion flaw.
The bug affects Chrome’s JavaScript and WebAssembly engine and could let a remote attacker execute arbitrary code inside the browser sandbox by using a specially crafted HTML page.
“CVE
Google patched 12 Chrome flaws, including an actively exploited V8 zero-day that could enable remote code execution through a crafted webpage.
Google released a Chrome security update fixing 12 vulnerabilities, including CVE-2026-85046 (CVSS score of 8.8), an actively exploited V8 type confusion flaw.
The bug affects Chrome’s JavaScript and WebAssembly engine and could let a remote attacker execute arbitrary code inside the browser sandbox by using a specially crafted HTML page.
“CVE-2026-85046: Type confusion in V8.” reads the advisory. “Google is aware that an exploit for CVE-2026-85046 exists in the wild.”
As usual, Google did not disclose technical details about the attacks exploiting this vulnerability or attribute them to any specific threat actor.
Security researcher Salvatore Gulizia, known as Serotav, reported the flaw on August 4, 2026, and received a $1,000 bug bounty.
“a v8 bug in the compilers that leads to an array containing PACKED_ELEMENTS to receive the map PACKED_SMI_ELEMENTS, this can be turned into arb r/w on the js heap.” wrote Serotav. “The bug was present in both maglev and turbofan.”
CVE-2026-85046 is the sixth actively exploited Chrome zero-day of 2026. Since the start of the year, Google has addressed the following zero-day flaws exploited in attacks in the wild:
February 2026 – CVE-2026-2441 (CVSS score: 8.8) – Use after free in CSS.
March 2026 – CVE-2026-3909 (CVSS score: 8.8) – Out-of-bounds write in the Skia 2D graphics library and CVE-2026-3910 (CVSS score: 8.8) – Flaw in the implementation of the V8 JavaScript/WebAssembly engine.
April 2026 – CVE-2026-5281 (CVSS score: 8.8) – Use-after-free bug in Dawn, the WebGPU component used for graphics processing.
June 2026 – CVE-2026-11645 (CVSS score: 8.8) – Out-of-bounds memory access in the V8 JavaScript engine
Google has updated Chrome Stable to version 152.0.7977.82/.83 for Windows and Mac and 152.0.7977.82 for Linux, with the rollout happening over the coming days and weeks.
OpenAI says Astra can autonomously find zero-days and build exploits, marking its first model to reach the “Critical” cyber risk level.
Astra is now officially OpenAI’s highest-risk cybersecurity model. In August, OpenAI said it “couldn’t rule out” that its upcoming model had reached the highest cybersecurity risk level in its Preparedness Framework. In a new post, the company confirmed it: Astra meets the Critical cybersecurity capability threshold, making it the first OpenAI model ever cla
OpenAI says Astra can autonomously find zero-days and build exploits, marking its first model to reach the “Critical” cyber risk level.
Astra is now officially OpenAI’s highest-risk cybersecurity model. In August, OpenAI said it “couldn’t rule out” that its upcoming model had reached the highest cybersecurity risk level in its Preparedness Framework. In a new post, the company confirmed it: Astra meets the Critical cybersecurity capability threshold, making it the first OpenAI model ever classified at that level.
“We now believe Astra meets the Critical cybersecurity capability threshold under our Preparedness Framework, meaning that with the right tools and access, it can find previously unknown security flaws and develop ways to exploit them across many well-protected systems without a person guiding each step.” reads the announcement. “It is the first model we are designating at this level, and requires stronger safeguards during development and before release.”
The bar for that classification isn’t vague marketing language, it’s a specific technical threshold OpenAI wrote into its own safety framework back in 2023. A model crosses it if it can identify and develop working zero-day exploits across many well-defended real-world systems entirely without human help, or if it can plan and carry out an entire cyberattack against a hardened target starting from nothing more than a high-level goal. Either condition alone is enough, and OpenAI says Astra clears the bar comfortably.
The benchmark results make the difference hard to ignore. Astra scored 100% on ExploitBench, a test that measures how well an AI can turn known vulnerabilities into working exploits.
OpenAI also tested Astra against a new internal benchmark based on V8 vulnerabilities disclosed between June and August 2026. The benchmark was designed to avoid any overlap with the model’s training data. Astra achieved much higher code-execution success rates than GPT-5.6 Sol while using far fewer tokens.
During the same tests, Astra also found two previously unknown zero-day vulnerabilities while building an exploit chain. OpenAI says it is now working with the affected software developers to disclose both flaws.
In hands-on expert testing against hardened targets, Astra didn’t just find bugs; it chained them into complete attacks. The model built a full browser-compromise chain that escaped the sandbox and executed commands directly on the host machine, triggered simply by opening a malicious HTML file. Separately, it found multiple flaws in a hardened operating system and combined them into a privilege-escalation chain running all the way from an unprivileged user account to root, the kind of end-to-end attack chain that used to require a skilled human operator stitching pieces together by hand.
The announcement comes just after OpenAI’s recent security incident. Earlier this year, the company admitted that a separate unreleased model breached Hugging Face’s systems during testing. OpenAI makes clear that Astra was not involved in that incident.
“Based on retrospective testing, we believe our production safeguards at the time would have prevented the Hugging Face incident.” states OpenAI. “We have since implemented even stronger safeguards for Astra, including training the model to more reliably refuse harmful cyber requests and respect safety restrictions, additional protections against misuse, and monitoring that can stop potentially unauthorized activity.”
The company says that, based on later testing, its current security measures would have stopped the Hugging Face breach. But that also suggests those safeguards were not in place when the earlier incident happened.
The response to reaching this threshold involved actually slowing down, not just adding a warning label. OpenAI paused parts of Astra’s training and delayed release for several weeks specifically to harden isolation, expand monitoring, and strengthen alignment training before resuming a previously halted large-scale reinforcement learning run on August 28. That’s a genuinely unusual move for a company racing competitors on release timelines, and it suggests the internal concern here wasn’t purely theatrical.
The refusal numbers show a clear improvement, although Astra is still not perfect. In OpenAI’s cyber safety tests, Astra refused 91.5% of requests that should not receive cyber assistance, compared with 59% for GPT-5.6 Sol.
OpenAI also ran a “honeypot” test based on the Hugging Face incident. The model was given an impossible task and quietly offered the option of attacking the test environment instead. Without production safeguards, GPT-5.6 Sol took the bait 56% of the time. Astra did it zero times.
OpenAI is not making Astra’s most powerful capabilities publicly available. Advanced cybersecurity features will first be given to a small group of alpha testers, before being expanded through a program called Daybreak Blue, focused on defensive security work.
This creates a deliberate access barrier. OpenAI also admits that its safeguards may sometimes block legitimate security research because it can look similar to malicious activity. In some cases, defensive work could therefore be paused or stopped simply because it resembles an attack.
The key shift is that AI-driven exploit discovery could make traditional patching timelines obsolete. The real challenge is becoming how quickly defenders can detect and respond when an AI finds a vulnerability before attackers exploit it.
Discover the details of three new NightmareEclipse vulnerabilities targeting Avast, Kaspersky, and NVIDIA components, lacking official vendor confirmation.
Related Posts:
CVE-2026-81934: Redis RCE PoC Exploit Now Public
CVE-2026-78319: SAUTER Controller RCE Flaw Disclosed
CVE-2026-82329 Exploited: JFrog Artifactory Admin Takeover
The post NightmareEclipse Releases PoCs for Avast, Kaspersky, and NVIDIA Flaws appeared first on Daily CyberSecurity.
Discover the details of three new NightmareEclipse vulnerabilities targeting Avast, Kaspersky, and NVIDIA components, lacking official vendor confirmation.
Chaotic Eclipse released HardBreacher, a PoC exploit for a Kaspersky Endpoint Security privilege escalation flaw, adding another zero-day to his list.
Security researcher Chaotic Eclipse, also known as INFINITE NIGHTMARE, MSNightmare and Nightmare-Eclipse, released a new zero-day exploit targeting Kaspersky Endpoint Security. The researcher named the exploit HardBreacher, it triggers a privilege escalation flaw.
Nightmare Eclipse says the Kaspersky Endpoint Security zero-day allows privil
Chaotic Eclipse released HardBreacher, a PoC exploit for a Kaspersky Endpoint Security privilege escalation flaw, adding another zero-day to his list.
Security researcher Chaotic Eclipse, also known as INFINITE NIGHTMARE, MSNightmare and Nightmare-Eclipse, released a new zero-day exploit targeting Kaspersky Endpoint Security. The researcher named the exploit HardBreacher, it triggers a privilege escalation flaw.
Nightmare Eclipse says the Kaspersky Endpoint Security zero-day allows privilege escalation on a fully patched Windows 11 25H2 system running Kaspersky Endpoint v14.0.0.504.
The researcher pointed out that the PoC is unstable and may require repeated attempts, but when successful, it creates a DLL in System32 with full user permissions.
The researcher also claims taking control of Kaspersky’s UI process can disrupt the antivirus and interfere with file-access controls, potentially leaving the system in an unstable state.
“The PoC is not in the best shape at all, it is basically duct tapped, I just managed to make it work and that’s all. It will fail to run with error so you just have to keep rerunning it. If it succeeds, it will create a file in C:\Windows\System32\MY_SNAKE_IS_SOLID.dll will full permissions for current user.” states Chaotic Eclipse. “The interesting part about this is the Kaspersky completely loses it when you take control over the UI process, you can cause it to stop functioning, grant/block access to files its not supposed to, if the PoC succeeds, the entire operating system becomes a hot mess.”
At this time, Kaspersky claimed it had already addressed the vulnerability.
Chaotic Eclipse, also known as Nightmare Eclipse, is a researcher known for publicly releasing PoC exploits for zero-day vulnerabilities, often after criticizing vendors’ handling of vulnerability reports. His releases have mainly targeted Microsoft products, including Windows and Microsoft Defender, with some later exploited in the wild. Among the most notable are the Undefend and RedSun Defender zero-days.
His work has fueled debate over responsible disclosure and the risks of publishing working exploits.
PaperCut vulnerability CVE-2026-82078 is exploited in the wild. Attackers run malicious SQL for RCE and a Metasploit PoC is public. Patch now.
Related Posts:
PoC Published for Linux Kernel Privilege Escalation CVE-2026-52933 Flaw
HardBreacher Exploit Targets Kaspersky
High-Severity Composer Flaw Enables Command Execution
The post CVE-2026-81578 & CVE-2026-82078: PaperCut Zero-Day Exploited, PoC Public appeared first on Daily CyberSecurity.
Discover the details of the experimental HardBreacher exploit targeting a potential zero-day vulnerability within Kaspersky Endpoint Security for privilege escalation.
Related Posts:
PoC Published for Linux Kernel Privilege Escalation CVE-2026-52933 Flaw
CVE-2026-81578 & CVE-2026-82078: PaperCut Zero-Day Exploited, PoC Public
High-Severity Composer Flaw Enables Command Execution
The post HardBreacher Exploit Targets Kaspersky appeared first on Daily CyberSecurity.
Discover the details of the experimental HardBreacher exploit targeting a potential zero-day vulnerability within Kaspersky Endpoint Security for privilege escalation.
Rapid7’s Metasploit Framework is set to add an exploit module targeting the actively exploited chain of vulnerabilities affecting PaperCut MF and PaperCut NG. This addition will provide public offensive tooling for a security emergency involving print management servers. The proposed module targets CVE-2026-81578 and CVE-2026-82078, two vulnerabilities that attackers can exploit to achieve remote code […]
The post Metasploit Adds Exploit for PaperCut MF/NG Zero-Day RCE Vulnerabilities appeared f
Rapid7’s Metasploit Framework is set to add an exploit module targeting the actively exploited chain of vulnerabilities affecting PaperCut MF and PaperCut NG. This addition will provide public offensive tooling for a security emergency involving print management servers. The proposed module targets CVE-2026-81578 and CVE-2026-82078, two vulnerabilities that attackers can exploit to achieve remote code […]
PaperCut confirms a NG/MF vulnerability exploited in the wild. Restrict server access now and apply the emergency patch for versions 25 and 26.
Related Posts:
Critical MongoDB Security Vulnerabilities Require Immediate Patching
CVE-2026-73125: Ebyte NA111-M Flaws Let Attackers Fully Compromise the Device
D-Link DIR-X1860Z Flaw Lets Attackers Change the Admin Password Without Login
The post PaperCut NG/MF Vulnerability Exploited in the Wild, Emergency Patch Released appeared first on Daily Cyb
PaperCut warns that a zero-day in NG and MF is being exploited. The company already release emergency patches to address it.
PaperCut Software warns that attackers are actively exploiting a zero-day in its NG and MF print management products. The flaw has no CVE yet, and the company has not released technical details.
PaperCut issued emergency patches on Friday and urged customers to install them immediately. It also recommends disconnecting application servers from the internet and limi
PaperCut warns that a zero-day in NG and MF is being exploited. The company already release emergency patches to address it.
PaperCut Software warns that attackers are actively exploiting a zero-day in its NG and MF print management products. The flaw has no CVE yet, and the company has not released technical details.
PaperCut issued emergency patches on Friday and urged customers to install them immediately. It also recommends disconnecting application servers from the internet and limiting access to trusted IP addresses.
“If your PaperCut NG/MF Application Server is accessible from the public internet, immediately restrict web access to trusted IP addresses only (e.g. internal IP addresses).” states the advisory. “Use firewall rules, network access controls, or equivalent measures to ensure the PaperCut server’s web interfaces cannot be reached from untrusted internet addresses. Take this action now, even if you have not observed suspicious activity.”
The company confirmed incidents affecting customers and said its investigation is still underway.
“PaperCut Software security response team is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF.” reads the advisory. “We are aware of confirmed customer incidents and are treating this matter with the highest priority. Our investigation is ongoing. We will update this security bulletin as verified information becomes available, including indicators of compromise and remediation guidance.”
PaperCut has not yet disclosed details about the vulnerability, the attack method, or the attackers behind the campaign.
So far, the company has identified several indicators of compromise:
Intrusion-detection, endpoint-security, or network-monitoring tools may flag suspicious activity involving the PaperCut Application Server, especially activity linked to pc-app.exe.
Attackers may delete, truncate, or alter PaperCut server.log files to hide their activity.
The server.log file may contain these entries:
ERROR No suitable driver found for jdbc:no:x
ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST
Users running PaperCut should check their systems for these signs of compromise.
In May 2023, Microsoft warned that Iran-linked APT groups were exploiting another flaw, tracked as CVE-2023-27350, in attacks against PaperCut MF/NG print management servers. The CVE-2023-27350 flaw is a PaperCut MF/NG Improper Access Control Vulnerability. PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of SYSTEM.
In April 2023, Microsoft linked the attacks exploiting the CVE-2023-27350 and CVE-2023-27351 vulnerabilities in print management software PaperCut to a financially motivated threat actor tracked as Lace Tempest (formerly DEV-0950). The group is known to be an affiliate of the Clop ransomware RaaS affiliate, it has been linked to GoAnywhere attacks and Raspberry Robin infection. Since April 13, 2023, Lace Tempest added the PaperCut exploits to its arsenal.
An unpatched Log4j RCE vulnerability was publicly disclosed on Apache's issue tracker. No CVE is assigned and no fix exists yet. Workaround inside.
Related Posts:
GitLab Updates Fix Arbitrary Command Execution Vulnerability
FreeBSD Patches Eight Kernel Vulnerabilities
UniFi CVE-2026-77537 (CVSS 10.0): Command Injection Flaws Hit 22 Ubiquiti Products
The post Public Disclosure: Unpatched Log4j RCE Flaw in FilteredObjectInputStream, No CVE Assigned appeared first on Daily CyberSecurity.
A recently disclosed security issue in Cursor IDE exposed a serious Windows binary-planting vulnerability that could allow malicious code to execute simply by opening an untrusted repository. This flaw, tracked as CVE-2026-63093, relates to Cursor’s executable resolution behavior and demonstrates how files controlled by attackers placed in a workspace could be executed with the current […]
The post Cursor 0-Day Lets Attackers Execute Malicious Code by Opening a Repository appeared first on GBHac
A recently disclosed security issue in Cursor IDE exposed a serious Windows binary-planting vulnerability that could allow malicious code to execute simply by opening an untrusted repository. This flaw, tracked as CVE-2026-63093, relates to Cursor’s executable resolution behavior and demonstrates how files controlled by attackers placed in a workspace could be executed with the current […]
GeoServer faces an unpatched zero-day enabling SQL injection and potentially RCE, with attackers already probing exposed systems.
A newly disclosed GeoServer zero-day is already attracting active exploitation attempts, and there is no patch available yet. Organisations running the open-source geospatial platform should check their exposure.
A security researcher with the handler q1uf3ng discloded the vulnerability that has yet to be assigned a CVE identifier.
实话说今天是非常不开心的一天 实际上最近一段时间
GeoServer faces an unpatched zero-day enabling SQL injection and potentially RCE, with attackers already probing exposed systems.
A newly disclosed GeoServer zero-day is already attracting active exploitation attempts, and there is no patch available yet. Organisations running the open-source geospatial platform should check their exposure.
A security researcher with the handler q1uf3ng discloded the vulnerability that has yet to be assigned a CVE identifier.
The flaw lies in the jsonArrayContains functionality and allows unauthorised SQL injection. Under some configurations, especially where the service can reach a privileged database account, that path may lead to remote code execution
The vulnerability has yet to be assigned a CVE identifier.
The issue was publicly disclosed on 12 August 2026. Within hours, watchTowr said it had begun seeing exploitation attempts, with hundreds of probes coming from a small number of IP addresses.
“Within hours of public disclosure, we began observing exploitation attempts and have since recorded hundreds of attempts originating from a small number of source IP addresses. Yet another example of how quickly attackers move once a vulnerability enters the public domain,” said WatchTowr’s Jake Knott.
That timing matters. Once a proof of concept or enough technical detail is public, attackers don’t need to wait for a polished exploit. They can scan broadly, trigger errors, compare responses, and build a list of systems worth revisiting later. It’s reconnaissance with an error message as a compass.
Threat actors are probing vulnerable GeoServer systems, but no follow-up activity has been observed yet. However, researchers warn exploitation could soon escalate.
“However, this is unlikely to remain the case for long: GeoServer has a track record of being targeted and exploited at scale, with multiple vulnerabilities listed in CISA’s Known Exploited Vulnerabilities catalog,” Knott added.
“With no patch currently available and exploitation already underway, organizations running GeoServer should take this vulnerability seriously and, where possible, identify exposed instances, restrict public access, and monitor for a vendor fix,”
Attackers are probing GeoServer systems for the unpatched zero-day, triggering errors to identify vulnerable targets before likely exploitation.
GeoServer is a popular platform for publishing and sharing geographic data through web services. It appears in public-sector portals, environmental platforms, mapping projects, utilities, transport systems, research institutions, and internal business applications. That makes a remotely reachable instance more than a technical footnote; it may expose geospatial information, backend services, credentials, or a route into a wider network.
The absence of a patch changes the usual response. Teams cannot simply schedule an update and move on. They need to identify every GeoServer instance, determine whether it is internet-facing, restrict access wherever possible, inspect logs for unusual requests and database errors, and limit the permissions available to the application’s database account.
This is also not GeoServer’s first encounter with active exploitation. In 2024, attackers used the critical GeoServer GeoTools vulnerability CVE-2024-36401 (CVSS score of 9.8), to pull compromised systems into DDoS and cryptocurrency-mining botnets and residential proxy networks. That history does not prove that every exposed instance will be compromised this time, but it does make complacency hard to defend.
The practical priority is exposure reduction. Put GeoServer behind a VPN, a reverse proxy, IP allow-listing, or another access-control layer if the service does not need to be public. If public access is unavoidable, treat it as a temporary high-risk exception, watch it closely, and prepare to apply the vendor fix as soon as it arrives.
Lazarus targets defense professionals with fake Lockheed Martin jobs, exploiting a Windows zero-day to deploy backdoors and evade security controls.
Check Point Research has uncovered a new wave of Operation Dream Job, the long-running North Korean campaign that lures defense and aerospace professionals with convincing fake job offers. This iteration is more dangerous than previous versions: it includes a previously unknown Windows vulnerability now patched as CVE-2026-68820, a newly documen
Lazarus targets defense professionals with fake Lockheed Martin jobs, exploiting a Windows zero-day to deploy backdoors and evade security controls.
Check Point Research has uncovered a new wave of Operation Dream Job, the long-running North Korean campaign that lures defense and aerospace professionals with convincing fake job offers. This iteration is more dangerous than previous versions: it includes a previously unknown Windows vulnerability now patched as CVE-2026-68820, a newly documented backdoor called Troy, and command infrastructure built almost entirely from legitimate servers the attackers didn’t build, they hijacked them. Targets confirmed in France, Germany, Brazil, and India.
“The attackers used a previously unknown vulnerability in Windows (CVE-2026-68820) to gain full control of infected computers and evade EDR visibility. Check Point reported the issue to Microsoft, which released a fix before this research was published” reads the report published by Check Point Research. “Rather than running their own servers, the attackers are hijacking legitimate but compromised websites and webmail servers to relay commands, making the malicious traffic harder to distinguish from normal activity”
The vulnerability, CVE-2026-68820, is the same actively exploited zero-day that Microsoft patched on August 11 as part of Patch Tuesday, a privilege escalation flaw in AFD.sys, the kernel driver underlying Windows Sockets. Check Point reported the issue to Microsoft on July 28, Microsoft confirmed it three days later, and the fix shipped two weeks after that. The zero-day in this campaign and the zero-day under active exploitation are the same bug.
The attack runs through two parallel infection chains. In the first, victims download an encrypted archive containing a legitimate signed PDF viewer and a malicious DLL. The DLL displays a convincing Lockheed Martin job description while silently loading MISTPEN, a lightweight downloader that communicates through Microsoft Graph API and OneDrive. MISTPEN then runs reconnaissance modules, triggers the AFD.sys exploit to achieve SYSTEM privileges, and deploys ForestTiger, a well-documented Lazarus backdoor, along with an updated version of the group’s kernel-mode rootkit, FudModule 3.1, which can now tamper with Windows Smart App Control to bypass software verification.
“The second chain is more recent and shares several characteristics with a campaign described by ESET against the UAV sector in 2025. Victims are instructed to download SecurityPDF, a trojanized PDF viewer, from one of several websites impersonating Enveil, a legitimate privacy technology company with no actual connection to the attack. Once installed, the modified viewer inspects any PDF opened through it for a hidden marker.” continues the report. “When the marker is present, the application decrypts and launches an embedded payload that loads the Troy backdoor directly into memory.”
Troy is a single DLL implant that supports 17 operator commands covering file operations, shell access, process termination, in-memory DLL injection, and configuration updates. Its name comes from a PDB path embedded in the binary that Check Point also observed in earlier Lazarus samples. Enveil has no connection to the campaign; its brand was simply borrowed because it sounds credible to defense sector professionals.
The C2 infrastructure is built from compromised Roundcube webmail installations and WordPress sites, many vulnerable to CVE-2025-49113, infected with a previously undocumented PHP webshell called RelayShell. RelayShell functions as a relay rather than a traditional backdoor, exchanging commands and responses through simple text files. In at least one confirmed case, an already-breached French organization was used to send phishing messages to new victims — the attackers borrowed the company’s reputation to get past filters. Check Point identified at least 17 unique server identifiers in this relay network, with operators connecting through commercial VPNs to further obscure their location.
The most urgent action is applying the August 2026 Patch Tuesday update, which contains the CVE-2026-68820 fix. For organizations running public-facing Roundcube or CMS installations, the secondary risk is becoming part of the relay infrastructure rather than the intended target: the servers used in this campaign were compromised through leaked credentials and a known unpatched vulnerability, not anything exotic. The full indicators of compromise are in Check Point’s report.
“Given the combination of a zero day vulnerability that now have a patch, a new modular backdoor, and web based infrastructure designed to resemble legitimate traffic, security teams in these sectors should prioritize the August Patch Tuesday update, review the indicators of compromise published in Check Point Research publication, and apply the same level of scrutiny to unsolicited recruiting outreach that they would apply to any unverified download request.” concludes the report.
Entrar
