mongodb

Cloud application hosting platform Northflank is warning customers to rotate all credentials and secrets stored on its platform after a security breach led to unauthorized use of customers' AI API keys. [...]

MongoDB ha rilasciato aggiornamenti di sicurezza per sanare alcune vulnerabilità, di cui 2 con gravità “alta”, nei prodotti Database Tools e Laravel. Tali vulnerabilità, qualora sfruttate, potrebbero consentire ad un utente malintenzionato di eludere i meccanismi di sicurezza e manipolare i dati sui sistemi interessati.

26,400 credentials that developers left in public code on Gitee, a Chinese code-hosting service, still worked when a researcher tested them. Anyone who copied one from that code could have used it. Independent researcher Ben Zimmermann found them by scanning 7.25 million public Gitee repositories and reported the results on October 28. Most were keys for cloud and AI services, led by

Disponibili Proof of Concept per diverse vulnerabilità, già sanate dal vendor, presenti nella componente C# Driver di MongoDB. Tali vulnerabilità, qualora sfruttate, potrebbero consentire a un utente malevolo di accedere a informazioni sensibili, manipolare i dati, compromettere la disponibilità del servizio o impersonare entità legittime sui sistemi interessati.

An investigation into a threat actor bypassing AI safety controls to coordinate credential theft, VoIP fraud planning, and database exfiltration. The post “Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities appeared first on Unit 42 .

La differenza tra un’infrastruttura difesa e un’infrastruttura semplicemente costosa non sta nel numero di prodotti di sicurezza acquistati, ma in ciò che succede quando un attaccante ha già un piede dentro. Nelle riunioni sul budget passano facilmente sempre le stesse voci: firewall di nuova generazione, EDR, SIEM, servizi MDR. Sono strumenti fondamentali, ma hanno un effetto poco nobile: si comprano e si mettono a bilancio. Molto più raramente si investe tempo nel fine tuning delle configurazioni dei sistemi che già abbiamo, che spesso restano ai default pensati per la compatibilità e non per la sicurezza. Eppure un dominio Active Directory che accetta ancora protocolli del 1993 e file server che non pretendono la firma dei pacchetti SMB possono vanificare buona parte di ciò che li circonda. Chi ottiene un primo accesso, magari con un semplice phishing , non ha bisogno di “bucare” il perimetro in quanto gli basta trovare un default permissivo e usarlo per muoversi lateralmente. Ci concentreremo su alcuni esempi in ambito Windows ma, come vedremo in seguito, il framework CIS prende in considerazione molti sistemi e software. Perché i default sono così permissivi? In Windows per garantire la compatibilità con quasi tutto ciò che è stato scritto negli ultimi trent’anni, molte configurazioni sicure sono opzionali . Un’azienda enterprise ha applicativi vecchi di quindici anni, NAS di terze parti, multifunzione e client che parlano protocolli superati. Se Microsoft cambiasse i default di colpo, mezzo mondo smetterebbe di funzionare. Il risultato è che la sicurezza reale viene demandata a chi amministra il sistema. La buona notizia è che esiste una guida condivisa e verificabile per correggere questi default: i CIS Benchmarks . In questo articolo vediamo da dove nascono, come sono strutturati e cosa cambia in pratica applicandoli, partendo da due casi concreti su Windows, NTLMv1 e la firma SMB , per poi allargare lo sguardo a cloud, rete, database e Linux. Vedremo anche perché l’adozione in un ambiente enterprise richiede mesi di test e come gli strumenti di compliance possano accelerare audit e remediation. Le origini: dal primo benchmark per Solaris a oltre cento guide Il Center for Internet Security (CIS) è un’organizzazione non profit statunitense nata come iniziativa di volontari, con l’obiettivo di produrre linee guida di configurazione pratiche e basate sul consenso. L’idea prende forma nel 2000 e il primo benchmark riguarda Solaris. Nel 2002 arriva il “Consensus Security Benchmark” per Windows 2000, frutto del lavoro congiunto di NSA, DISA, FBI, SANS e CIS. Nel 2008 debutta CIS-CAT, lo strumento per misurare la conformità. Il tratto distintivo è proprio il consenso . Un benchmark non è l’opinione di un singolo vendor. Nasce dal lavoro di esperti di governo, accademia e industria, passa da fasi di proposta, test e revisione e viene pubblicato in bozza per commenti pubblici prima della versione finale. Oggi se ne contano più di cento, su oltre venticinque famiglie di prodotti . I PDF sono gratuiti per uso non commerciale , mentre gli strumenti di automazione (CIS-CAT Pro, Build Kit, immagini hardened) richiedono la membership SecureSuite. Cosa contiene un benchmark e cosa significano L1 e L2 Attenzione a non confonderli con i CIS Controls , che sono azioni di alto livello e prioritizzate, come l’inventario degli asset o la gestione delle vulnerabilità. I Benchmark sono invece documenti tecnici, uno per ogni prodotto e versione, che spiegano come configurarlo. Ogni raccomandazione descrive il rischio che riduce, il profilo a cui appartiene e, soprattutto, l’ impatto che può avere sul sistema: è la parte da leggere prima di applicare qualsiasi cosa. Poi indica come verificare lo stato attuale (percorso GPO, chiave di registro o comando), come correggerlo e qual è il valore di default , che è spesso il campo più istruttivo, perché misura la distanza tra ciò che il sistema fa da solo e ciò che dovrebbe fare. Le raccomandazioni sono organizzate in livelli : Level 1 (L1): la base, applicabile con relativa rapidità e senza impatti pesanti. Riduce la superficie d’attacco mantenendo i sistemi usabili. Level 2 (L2): la difesa in profondità, pensata per ambienti in cui la sicurezza è prioritaria. Può limitare funzionalità e richiede una gestione delle eccezioni. A questi si aggiungono profili opzionali come BitLocker (BL) , Next Generation Windows Security (NG) e, in alcuni casi, un profilo allineato alle STIG del DoD statunitense. Nei benchmark Windows Server, L1 e L2 esistono poi in versione Domain Controller e Member Server , perché un DC non si hardenizza come un file server. Alcuni esempi con il benchmark per Windows Server Ho preso come esempio il CIS Benchmark per Windows Server 2022 (versione 5.1.0). E’ possibile scaricarlo, o scaricarne altri, è necessario eseguire la registrazione gratuita su https://learn.cisecurity.org/benchmarks Dopo la registrazione si accede a un’ampia raccolta di benchmark. In questo caso prendiamo come esempio due configurazioni di Windows: NTLMv1 e la firma SMB. Un sistema Windows, server o client, senza particolari criteri di gruppo si attesta intorno al 20% di compliance rispetto al benchmark. NTLMv1: il vecchio protocollo che non se ne va NTLM è un protocollo di autenticazione challenge/response che convive con Kerberos in Active Directory. Ogni volta che Kerberos non è utilizzabile (accesso tramite IP, SPN sconosciuto, client fuori dominio) Windows ripiega su NTLM. La versione 1 usa crittografia debole: gli hash catturati sulla rete possono essere attaccati offline o inoltrati in attacchi di relay, ed è per questo una delle cause principali dei movimenti laterali (pass-the-hash o PtH) e privilege escalation (PE). In questo precedente articolo avevamo simulato gli effetti di questo protocollo e le conseguenze. Il benchmark raccomanda, al livello L1, di impostare Network security: LAN Manager authentication level su “Send NTLMv2 response only. Refuse LM & NTLM” . Nel Windows Server 2022 Benchmark v5.1.0 è la raccomandazione 2.3.11.7 , ma la stessa indicazione era già presente nel benchmark per Server 2012 R2 del 2016. La numerazione cambia tra le versioni, quindi verificate sempre quella del documento che state usando. Il dettaglio interessante è il default: i client usano già solo NTLMv2, ma i Domain Controller accettano ancora LM, NTLM e NTLMv2 . Un dominio “pulito” per impostazione predefinita accetta quindi protocolli obsoleti, e basta un dispositivo datato per continuare a usarli. La configurazione si fa da GPO in Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → Security Options oppure direttamente dal registro, alla chiave HKLM\SYSTEM\CurrentControlSet\Control\Lsa, impostando il valore LmCompatibilityLevel (REG_DWORD) a 5. Anche se le configurazioni risultano complicate da capire, il documento CIS è una guida chiara su cosa applicare e cosa non, con dettagli chiari riguardo all’impatto che leggiamo qui sotto. Sui DC, i client che non supportano NTLMv2 non riusciranno più ad autenticarsi. Un vecchio client XP o 2000 fallisce il logon, incrementa il contatore delle password errate e, con il lockout attivo, può portare al blocco dell’account. Il percorso corretto è quindi audit, identificazione, migrazione ed enforcement , mai il contrario. Il benchmark include le impostazioni di auditing NTLM (le 2.3.11.12–14) e nel Security log l’evento 4624 riporta il pacchetto di autenticazione usato: cercate le sessioni con “NTLM V1”. Piccola nota : NTLMv1 è stato rimosso da Windows 11 24H2 e Windows Server 2025 , a prescindere dal valore di LmCompatibilityLevel. Restano però dei residui di crittografia derivata da NTLMv1 in scenari come MS-CHAPv2 nei domini, per cui Microsoft sta introducendo modalità audit ed enforcement (con l’evento 4024) e raccomanda l’uso di Credential Guard . Il problema è che la flotta reale non è tutta 24H2. Finché convivono Windows 10, Windows 11 23H2 e Server 2016/2019/2022, la questione è viva. E la sola GPO potrebbe non bastare: secondo la ricerca di Silverfort , chi si affida solo alle policy resta esposto e deve anche rilevare e mitigare l’uso di NTLMv1. Il quadro più ampio è una roadmap in tre fasi : NTLM è deprecato da giugno 2024, l’auditing avanzato è già disponibile e con la prossima versione di Windows Server e dei client verrà disabilitato di default . Non rimosso, ma riabilitabile via policy. Chi ha già fatto il lavoro di audit parte in netto vantaggio. Firma SMB: il default che (quasi) non ti protegge Senza firma, i messaggi SMB non hanno alcuna garanzia di integrità né di autenticità. Un attaccante sulla rete può inoltrare un’autenticazione NTLM catturata verso un altro server e agire con l’identità della vittima. La firma inserisce in ogni messaggio un hash generato con la chiave di sessione, così qualsiasi manomissione viene rilevata e il relay attack viene bloccato. Sento spesso dire che la firma SMB è ormai obbligatoria di default. È vero solo in parte. Secondo la documentazione Microsoft , Windows 11 24H2 nelle edizioni Pro, Enterprise ed Education la richiede sia in uscita sia in ingresso, mentre Windows Server 2025 la richiede solo in uscita . Sull’edizione Home le pagine Microsoft non sono coerenti tra loro, ma in ambito enterprise non è rilevante. Sulle versioni precedenti (Windows 10 e Server fino al 2022) la firma era richiesta di default solo per le connessioni alle share SYSVOL e NETLOGON dei domain controller. In un’infrastruttura reale, con file server 2016, 2019 o 2022, il default non ti protegge . E nemmeno 24H2 chiude la partita: come osserva DSInternals , queste modifiche eliminano alcuni vettori di relay ma non mitigano la tecnica del tutto. Il CIS prevede due raccomandazioni L1, una per lato: Microsoft network client: Digitally sign communications (always) , la 2.3.8.1 , e la 2.3.9.2 Microsoft network server: Digitally sign communications (always) , entrambe su Enabled . Nel registro si trovano sotto LanManServer\Parameters e LanManWorkstation\Parameters, con il valore RequireSecuritySignature impostato a 1. Anche qui, l’impatto. Il server non comunicherà con client che non accettano la firma. La richiesta può bloccare le connessioni verso computer in workgroup, share con accesso guest e server SMB di terze parti che non la supportano: NAS datati, apparati embedded, Samba non configurato, scanner con scan-to-folder. L’errore tipico è STATUS_INVALID_SIGNATURE (0xc000a000). Ogni pacchetto va inoltre firmato e verificato, quindi su server multiruolo il rallentamento può essere sensibile. La strada è sempre la stessa: inventariare share e client legacy, aggiornare, sostituire o segmentare i dispositivi non compatibili e applicare la policy a ondate. Altri default da rivedere Questi due casi sono la punta dell’iceberg. Sempre in ambito Windows, il benchmark ci ricorda per esempio di (tra parentesi il codice della raccomandazione e il livello): Disattivare LLMNR e NetBIOS , che permettono il poisoning delle richieste di risoluzione dei nomi (con strumenti come Responder) per rubare hash NTLMv2 (18.6.4.4 per LLMNR; 18.4.6 e 18.6.4.2 per NetBIOS; L1). Firmare LDAP e abilitare il channel binding , contro i relay verso i DC. Su Server 2025 la firma LDAP è di fatto richiesta salvo disattivazione esplicita, mentre su 2019 e 2022 il default era permissivo e il channel binding non è richiesto di default (2.3.5.4 firma e 2.3.5.3 channel binding sui DC, 2.3.11.9 firma lato client; L1). Verificare che SMBv1 sia assente : non è installato di default su Windows 11 e Server 2019 e successivi, ma nei parchi stratificati va controllato (18.4.2 driver client e 18.4.3 server; L1). Controllare che WDigest sia disattivo (UseLogonCredential=0), per non lasciare password in chiaro nella memoria di LSASS (18.4.7; L1). Limitare le cifrature Kerberos deboli come RC4 e DES, più facili da attaccare offline (2.3.11.4; L1). Disabilitare il Print Spooler sui Domain Controller , dove non serve (5.1, L1; sui Member Server 5.2, L2), e chiudere l’enumerazione anonima di utenti e share (2.3.10.2 e 2.3.10.3; L1). Attivare LSA Protection e Credential Guard contro il furto di credenziali dalla memoria (LSA Protection 18.9.26.2 e Credential Guard 18.9.5.5 sui Member Server; entrambi profilo NG). Sui DC il benchmark prevede invece Credential Guard disabilitato (18.9.5.6). Codici e livelli (L1, L2 o NG) sono quelli del benchmark per Windows Server 2022 e possono cambiare da una versione all’altra, quindi confrontateli sempre con il documento di riferimento. Il CIS non copre solo Windows I CIS Benchmarks coprono ormai gran parte di ciò che compone un’infrastruttura moderna. Includono: cloud provider (AWS, Azure, Google Cloud, Alibaba, IBM Cloud, Oracle Cloud) e le piattaforme SaaS come Microsoft 365, Google Workspace e Dynamics 365 Power Platform. sistemi operativi , da macOS ad AIX e Solaris, fino a un’ampia famiglia Linux (RHEL, Rocky, AlmaLinux, Debian, Ubuntu, SUSE, Amazon Linux, Bottlerocket e altre) server software , come database (SQL Server, Oracle, MySQL, PostgreSQL, MongoDB), web server (Apache, NGINX, Tomcat, IIS), Docker, Kubernetes e VMware. E ci sono gli apparati di rete (Cisco, Fortinet, Palo Alto, Check Point, Juniper, F5, Sophos, pfSense), i software desktop (Exchange, Office, Zoom, i principali browser), i dispositivi mobili iOS e Android e persino le stampanti multifunzione . Il catalogo si è spinto fino alla software supply chain : il primo benchmark riguardava un sistema Unix , oggi ne esiste uno per la sicurezza della catena di sviluppo, e questo racconta bene come è cambiata la superficie d’attacco. La logica è la stessa ovunque: il rischio sta nelle configurazioni lasciate ai default . Nel cloud, il rischio dominante non sono gli exploit sul provider ma le misconfigurazioni lato cliente: MFA mancante sugli account privilegiati, chiavi di accesso sul root , logging di audit disattivato, storage pubblico, gruppi di sicurezza che espongono SSH o RDP a tutta Internet. Sugli apparati di rete, firewall e switch entrano spesso in produzione con la configurazione minima, con interfacce di gestione raggiungibili ovunque, Telnet, HTTP e SNMPv1/v2c ancora attivi e credenziali di default. Su database e web server il benchmark chiede autenticazione obbligatoria, ascolto solo sulle interfacce necessarie e TLS moderno; su Docker e Kubernetes, container non privilegiati, accesso anonimo all’API server disabilitato e RBAC corretto. Le multifunzione, infine, sono computer completi con disco, rete e credenziali di dominio, ma raramente vengono trattate come tali: è lo stesso ragionamento dei NAS che non supportano la firma SMB. E Linux? Vale lo stesso discorso, con profili separati per Server e Workstation: SSH con login root disabilitato e autenticazione a chiave, /tmp montato con nodev,nosuid,noexec, filesystem inutili disabilitati, ASLR attivo, firewall in deny di default e auditd configurato. Nella documentazione di Wazuh un Ubuntu 22.04 con le impostazioni di default supera 56 controlli CIS su 191 (87 falliti, 48 non applicabili), con un punteggio del 39%. Anche un Linux appena installato è ben lontano da un hardening accettabile. Più di tre mesi di lavoro: non è un’attività da weekend Ammetto una cosa che nei tutorial di solito manca: applicare un benchmark in un ambiente enterprise eterogeneo non significa importare una GPO . Nella mia esperienza ci sono voluti più di tre mesi , quasi tutti spesi in test interni su sistemi diversi tra loro, perché molte regole hanno impatti significativi. Il metodo che ha funzionato parte da un inventario onesto di sistemi operativi, ruoli (DC, file server, workstation, laboratori, sistemi industriali) e applicativi legacy. Da lì serve un profilo per ogni ruolo : kiosk, workstation di sviluppo, PC di produzione e macchine con dipendenze VPN o di stampa datate non possono ricevere lo stesso baseline, e le eccezioni vanno documentate. Dove esiste una modalità audit, come per NTLM e LDAP, si parte da lì e si leggono i log per settimane. Poi si procede a ondate , dal laboratorio al pilota IT, al reparto pilota, all’intera azienda, monitorando ticket e log a ogni passaggio, con un backup delle GPO e una procedura di rollback già testata. Fondamentale il registro delle eccezioni . Ogni deviazione dal benchmark deve avere un responsabile, una motivazione e una data di revisione, perché un’eccezione senza scadenza diventa un default. Il Level 2 va infine trattato come un progetto a parte, perché cambia il carico di eccezioni e il modello di supporto. E il benchmark è più facile da difendere quando le basi funzionano già: patching, Defender, chiavi BitLocker, password dell’admin locale e monitoraggio di base. Gli strumenti che accelerano Fare tutto a mano su centinaia di macchine non è realistico e ancor più avere tutto sotto controllo, in particolare quando cominciano a nascere dei problemi. Gli strumenti di compliance eseguono un audit automatico sul parco macchine, associano a ciascun sistema il benchmark CIS di riferimento e producono report che mostrano dove intervenire , con priorità. Ce ne sono di commerciali, come ManageEngine, Tenable Nessus, Qualys e Rapid7, oltre a CIS-CAT Pro, lo strumento ufficiale del CIS. Controllate sempre che siano certificati CIS per la versione del benchmark che vi serve. Tra le soluzioni open source vale la pena conoscere il modulo SCA (Security Configuration Assessment) di Wazuh . L’agent Wazuh scansiona l’endpoint con delle policy in formato YAML , abilitate di default e già basate sui CIS Benchmarks. Tra le policy incluse ci sono Windows 10 e 11, Windows Server dal 2012 R2 al 2025, le principali distribuzioni Linux e alcune applicazioni come IIS, NGINX e SQL Server. Dalla dashboard si vede, per ogni macchina, quanti controlli sono superati o falliti e con quale punteggio, con descrizione e remediation di ogni check. Ed è esattamente la fotografia di partenza che serve prima di toccare una GPO. Dashboard Wazuh, modulo Configuration Assessment, con il riepilogo della policy CIS su un agent Windows (Passed / Failed / Not applicable e punteggio). Dettaglio di un check, ad esempio LmCompatibilityLevel, con razionale e remediation. L’SCA rileva e riporta, ma non corregge: la remediation resta a GPO o gestione della configurazione. E come per ogni scanner, un report non sostituisce il giudizio dell’analista. Nella community sono stati segnalati falsi positivi dovuti a errori nelle regole (per esempio uno spazio di troppo in un check Windows), quindi un controllo fallito su un sistema che sembra a posto va verificato a mano prima di intervenire. Una nota dolente è che di default le baseline non sono aggiornate. Infatti attualmetne ci troviamo le verisoni v2.0.0 quando sono state appena rilasciate le v5.1.0, quindi potrebbero mancarne. Un altro strumento interessante è ManageEngine Vulnerability Manager Plus che, oltre alle funzionalità di vulnerability discovery e patch management , dispone di un modulo di compliance in cui è possibile associare gruppi di host ai benchmark e valutarne rapidamente la conformità. Dashboard ManageEngine Endpoint Central, modulo Conformità, con lo stato di conformità di un gruppo di computer, la suddivisione per fasce di percentuale e il dettaglio per singolo host. Dettaglio della scansione con il CIS Microsoft Windows 10 Enterprise Benchmark v2.0.0 (Level 1, BitLocker): 20% di conformità, con la regola sul livello di autenticazione LAN Manager (NTLMv2) segnalata come non superata e la relativa remediation. Conclusione Firewall ed EDR restano strati indispensabili, ma poggiano su sistemi che, lasciati ai default, offrono scorciatoie note da vent’anni: NTLMv1 accettato dai DC, share senza firma SMB, LLMNR attivo, LDAP non firmato, console di gestione esposte, bucket pubblici. È questo che trasforma un singolo endpoint compromesso in un dominio compromesso. I CIS Benchmarks non sono una bacchetta magica, ma sono un punto di partenza concreto, condiviso e verificabile . Dicono cosa cambiare, dove, con quale impatto e come dimostrare di averlo fatto. Il prezzo è il tempo, tra test, eccezioni e comunicazione con gli utenti. In cambio si riduce la superficie d’attacco in modo strutturale, senza acquistare nulla di nuovo. L'articolo Basta un PC compromesso per entrare in tutta l’azienda! La colpa? I vecchi default di Windows proviene da Red Hot Cyber .

MI5 has warned that more than 100 UK-linked academics contributed to research projects allegedly funded to improve China's spying capabilities. The Security Service issued an unusually public espionage alert this week naming the China General Technology Research Institute (CGTRI), also translated as the China Academy of General Technology (CAGT). MI5 says the organization has "very strong ties" to China's Ministry of State Security (MSS), the country's civilian intelligence agency. According to MI5, CGTRI's "primary purpose" is to fund academic research that directly improves the MSS's technical espionage capabilities. More than 100 UK-linked academics have contributed to CGTRI-funded projects involving AI, cybersecurity, covert communications, and steganography, the agency said. Some may not have known who was ultimately financing the work. "This activity supports MSS espionage, which poses a threat to UK national security," MI5 said. MI5 isn't accusing all of the academics involved of knowingly helping Chinese intelligence. Its alert acknowledges that many institutions and individuals likely dealt with CGTRI "in good faith" because of what it describes as the organization's "obfuscated links" to the MSS. MI5 "strongly advised" UK universities to review immediately any current or planned collaboration with CGTRI and ensure that the MSS derives no further benefit from British research. Academics working with Chinese institutions are also being told to establish who is ultimately funding the research and make sure CGTRI isn't involved. Researchers may also want to brush up on the National Security Act 2023. MI5 specifically highlighted two offenses: assisting a foreign intelligence service under section 3 and obtaining a material benefit from one under section 17. Under section 3, a person can commit an offense if their conduct is likely to materially assist a foreign intelligence service with UK-related activities and they know, or "ought reasonably to know," that it is likely to do so. Section 17 separately covers accepting or retaining a material benefit when the recipient knows, or ought reasonably to know, that it came from a foreign intelligence service. Legitimate payment for lawful goods or services is excluded. Having publicly identified CGTRI's alleged links to Chinese intelligence, MI5 warned that any institution or researcher continuing to conduct work funded by the organization should seek independent legal advice. In other words, MI5 has put universities on notice: not knowing who was really behind the research money may have been understandable yesterday, but it is a considerably trickier argument today. ®

Britain's data protection watchdog has acquired a new legal identity and governance structure, although the familiar ICO initials are staying put. On September 30, the Information Commission replaced the Information Commissioner as the statutory regulator. The organization itself will be known as the Information Commission's Office and will continue using the ICO name. The change is more than a bureaucratic rebrand. The former regulator was a "corporation sole," meaning its statutory powers and responsibilities were vested in one person: the Information Commissioner. Those functions have now transferred to a corporate body overseen by executive and non-executive board members. The new structure was created by the Data (Use and Access) Act 2025, which received Royal Assent in June 2025. The government says it will modernize the watchdog's governance without changing its existing regulatory functions. The transition follows an awkward final few months under the old structure. Information Commissioner John Edwards resigned in June after an independent workplace investigation into his conduct, admitting that his position had become "untenable" and that attempts at humor had been "inappropriate and caused offense." Edwards had stepped back from his duties in April, and the ICO removed his remaining responsibilities after the investigation concluded there was "a case to answer." Paul Arnold, who assumed Edwards' statutory responsibilities before his resignation, is serving as interim chief executive of the Information Commission. Seven non-executive members have joined the new board. They appointed Maggie Carver deputy chair, and she will perform the chair's duties while the government searches for somebody to fill the job permanently. That recruitment process isn't expected to wrap up until spring 2027. The regulator has also packed its boxes and moved its headquarters from Wilmslow to Oxford Road in Manchester, which it says will give it access to a "diverse talent pool" and strengthen links with businesses and communities across the UK. For anyone dealing with the watchdog, little should change day to day. The Information Commission retains responsibility for data protection and freedom of information regulation, along with the ICO's existing powers, guidance, and public services. A new corporate strategy is also on the way, with AI, cyber resilience, children's privacy, and public services among the areas singled out for attention. Anyone attached to the old initials can relax: despite the legal and governance overhaul, even the Information Commission's Office intends to keep calling itself the ICO. ®

Truffle Security has discovered over half a million active unique credentials exposed in public GitHub repositories. A total of 1,103,438 exposed credentials were discovered through the scanning of 224 million public GitHub repositories in August 2025. At the end of July 2026, the security firm tested the credentials against their services and found that 543,699 of them were still active. The oldest is an AWS key that was committed in 2009 and has remained untouched since. The median exposure window across the set is 784 days. “2,636 live credentials come from files last modified before 2015. A quarter of everything we found is older than four years,” Truffle Security says. The most concerning part is that nearly half of the credentials were pushed to the public repositories after GitHub enabled free alerts and default push protections to prevent the inadvertent exposure. “245,959 credentials predate free alerts. 97,897 arrived while scanning was free and push protection was one setting away. 199,843 landed after the block became the default, and were still answering to their providers more than two years later,” Truffle notes. GitHub also runs a secret-scanning program that sends exposed tokens to the providers that issued them for revocation. However, it does not require partners to revoke the identified secrets, which explains the large number of credentials that remain active. The list of exposed secrets is dominated by 69,041 Google Cloud service account credentials, 51,067 MongoDB connection strings, and 33,343 live Google API keys. According to Truffle, the credentials remain active not because their exposure was not prevented, but because they were not revoked, as providers may not have a pipeline that kills the leaked tokens. “Push protection is a good control and stops secrets at the door. It has nothing to say about the 543,699 already inside, and it was never meant to. Alerts do cover history, but only where an owner enabled them, read them, and then went and rotated the key,” Truffle notes. Related: Malicious B-tree NPM Package Accumulates Millions of Downloads Related: This Key Will Self-Destruct: An Open Standard for Revocable API Keys Related: “We Think the Security Control Is Working” Is No Longer Good Enough Related: US, Australia Release OT Isolation Guidance for Critical Infrastructure

The Spectre microarchitecture vulnerability has returned yet again, this time to vex just-in-time (JIT) engines that generate machine code for browsers, runtimes, and kernels. The vulnerability is found in many CPUs that use speculative execution, the process of executing code before it is called to boost performance. Researchers found speculative execution opens the door to side channel attacks through which secrets can be exposed or inferred. When news of that risk became known, chipmakers and OS developers scrambled to fix these vulnerabilities, which were referred to as Spectre and Meltdown. And since then, researchers have found two or three dozen variations, such as 2025's VMScape, one of several so-called "Spectre v2" attacks that attempt to exploit indirect branch prediction, where program control is passed indirectly by pointing to an address where the next instruction can be found rather than specifying the instruction itself. The attacker trains the branch predictor to execute speculatively to a chosen address in order to leak data about the microarchitecture state. Researchers from Vrije Universiteit in the Netherlands and Scuola Superiore Sant’Anna in Italy have revived Spectre in a form called Branch Target Reuse (BTR), which they describe as the first practical in-place Spectre v2 attack that attacks just-in-time (JIT) compilers. An in-place attack is confined to the victim's branch while an out-of-place attack relies on speculation directed toward a target on a different branch. The researchers – Sander Wiebing, Yuhui Zhu, Alessandro Biondi, and Cristiano Giuffrida – found that this novel Spectre form can be conjured from code left in JIT engines including Linux cBPF, Oracle GraalVM, and Mozilla SpiderMonkey. "The key insight behind the attack is that, while modern CPUs restore architectural code coherence after self-modification, they do not necessarily invalidate stale indirect branch prediction entries (i.e., branch targets)," the authors explain. "In JIT engines, these stale targets can outlive the original code and later be reused when the code cache is repopulated, yielding a speculative execute-after-free primitive." The result is that an attacker can commandeer speculative control flow in a way that avoids some software defenses like FineIBT [PDF]. The authors showed they could exploit this flaw by designing two proof-of-concept exploits against an Intel-based Linux kernel that reveal the root password hash even with the constant binding defense provided by cBPF. The expected leakage rate is 5.7 KB/sec for Intel Raptor Cove chips and 5.4 KB/sec for Lion Cove. It's slow but enough for an unprivileged user to coax a sensitive password hash out of a vulnerable system. After the researchers disclosed their findings, Linux kernel developers and Oracle put mitigations in place. Two CVEs were assigned: CVE-2026-64507 and CVE-2026-64508. Mozilla, the researchers said, has opted to prioritize work on site isolation instead of addressing the issue directly. Strong mitigations like IBPB are said to be effective but add complexity and hinder performance. The Branch Target Reuse paper has been accepted for publication at the ACM Conference on Computer and Communications Security (CCS) 2026, which will be held November 15 through 19 in The Hague, Netherlands. ®

The FBI’s cyber chief has a message for the criminals that hacked the bureau’s jobs portal last week: "We know how to find you," so turn yourself in. In a video message following the Dutch National Police’s arrest of a 24-year-old whom the FBI described as “one of the alleged leaders of ShinyHunters,” Brett Leatherman, assistant director of the FBI's Cyber Division, had some advice for the “remaining members” of the data theft and extortion gang. “We're confident you've seen or heard things in recent days that the public has not,” Leatherman said. “Other groups believed anonymity or their friends would protect them, and they were wrong. Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who's left. The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out first while the choice is still yours.” The FBI declined to answer The Register’s questions about the video message, including whether it had seized any of the cybercrime group’s infrastructure, and whether any of ShinyHunters’ members had taken Leatherman up on his offer to “reach out first.” After the Dutch suspect’s arrest, police said on Tuesday that they uncovered “a large amount of information” on the man’s laptop, “including details about two murders that were to be committed abroad. There are indications that the suspect gave the order for this.” According to FBI Director Kash Patel, the feds assisted Dutch investigators in cuffing the 24-year-old suspect. In a subsequent xeet, the bureau said that cops seized electronic devices and are investigating additional leads: “More arrests possible.” Early last week, ShinyHunters hacked the FBIJobs.gov portal and claimed to steal sensitive personal details about current, former, and prospective FBI employees. But unlike the group’s typical theft-and-extortion intrusions, a spokesperson told The Register that this one was “NOT financially motivated … We want the FBI to correct or retract their statements they made, which included substantial false allegations.” Later, in an exclusive interview, the spokesperson told us the attention-grabbing hack would preserve ShinyHunters’ reputation and keep its “business” afloat. “It’s a game and it’s the world we live in,” a ShinyHunters spokesperson said. “We are just protecting our business as any other business would do. It’s about who does their job better.”®

Authorizer is an open-source server for sign-in and access control in web and mobile apps. Teams run it on their own infrastructure and keep user accounts in a database they choose. Its maintainers have built a permissions engine and an interface for AI agents into the same Go program that logs users in, so a chatbot can ask whether a user may see a document before it fetches that document. This affects any team that … More → The post Authorizer: Open-source authentication and authorization for your apps appeared first on Help Net Security .

MongoDB ha rilasciato aggiornamenti di sicurezza per risolvere 5 vulnerabilità con gravità "alta" nei prodotti Python Driver (PyMongo), C Driver, Compass e Laravel MongoDB. Tali vulnerabilità, qualora sfruttate, potrebbero consentire a un utente malintenzionato di eseguire codice arbitrario, accedere a informazioni sensibili, alterare i dati e compromettere la disponibilità del servizio sui sistemi interessati.

Aggiornamenti di sicurezza sanano nuove vulnerabilità, di cui 3 con gravità "critica" e 6 con gravità "alta", in MongoDB C Driver e Mongoid. Tali vulnerabilità, qualora sfruttate, potrebbero consentire a un utente malintenzionato di eludere i meccanismi di sicurezza, accedere a informazioni sensibili, alterare o eliminare dati e compromettere la disponibilità del servizio sui sistemi interessati.

With artificial intelligence (AI) shrinking the window between vulnerability discovery and exploitation and lowering the barrier to entry for bad actors, new findings from Sysdig show that skilled human operators can move just as swiftly after gaining initial access. In one instance highlighted by the cloud security company, the threat actor pivoted from a vulnerable Marimo notebook to an SSH

Risolta vulnerabilità in MongoDB Server Alert AL03/260914/CSIRT-ITA Sintesi Aggiornamenti di sicurezza sanano una vulnerabilità con gravità "alta" che interessa MongoDB Server, sistema di gestione di basi di dati documentali utilizzato per archiviare, gestire ed elaborare grandi quantità di informazioni. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un utente malintenzionato autenticato, con privilegi di lettura/scrittura sul database, di compromettere la disponibilità del servizio e manipolare i dati sui sistemi interessati. Tipologia Denial of Service Data Manipulation Prodotti e/o versioni affette MongoDB Server 8.3.x, versioni precedenti alla 8.3.11 8.0.x, versioni precedenti alla 8.0.32 7.0.x, versioni precedenti alla 7.0.43 Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni dei relativi bollettini di sicurezza riportati nella sezione Riferimenti.

Rilevate vulnerabilità in prodotti MongoDB Alert AL05/260911/CSIRT-ITA Sintesi Aggiornamenti di sicurezza MongoDB sanano molteplici vulnerabilità, di cui 5 con gravità "alta", presenti nel framework PHP Laravel MongoDB Integration e nelle librerie Java Driver e C# Driver di MongoDB. Tali vulnerabilità, qualora sfruttate, potrebbero consentire ad un utente malintenzionato di accedere a contenuti sensibili, di manipolare le informazioni e compromettere la disponibilità del servizio sui sistemi interessati. Tipologia Denial of Service Information Disclosure Data Manipulation Prodotti e/o versioni affette MongoDB Java Driver versioni precedenti alla 5.11.1 MongoDB C# Driver versioni precedenti alla 3.11.2 Laravel MongoDB Integration versioni precedenti alla 5.11.0 Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni dei relativi bollettini di sicurezza riportati nella sezione Riferimenti. Di seguito sono riportate le sole CVE relative alle vulnerabilità con gravità “alta”:

Rilevate vulnerabilità in prodotti MongoDB Alert AL07/260828/CSIRT-ITA Sintesi Rilevate molteplici vulnerabilità, tra cui 6 con gravità “alta”, in varie librerie client per MongoDB. Tali vulnerabilità, qualora sfruttate, potrebbero consentire a un utente malintenzionato la modifica non autorizzata di dati o codice e la compromissione della disponibilità del servizio sui sistemi interessati. Tipologia Denial of Service Tampering Prodotti e/o versioni affette MongoDB C#/.NET Driver 3.x, versioni precedenti alla 3.11.1 MongoDB Rust Driver 3.x, versioni precedenti alla 3.8.2 MongoDB PHP Library 1.x, versioni precedenti alla 1.21.6 2.x, versioni precedenti alla 2.4.1 MongoDB C++ Driver versioni dalla 3.0.0 alla versione 4.5.1 inclusa MongoDB Go Driver versioni dalla 2.1.0 alla versione 2.8.2 inclusa MongoDB Connector for BI versioni dalla 2.4.0 alla versione 2.14.30 inclusa Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni dei bollettini di sicurezza riportati nella sezione Riferimenti. Di seguito sono riportate le sole CVE relative alle vulnerabilità con gravità “alta”: Argomenti Data pubblicazione 28/08/26 ore 14:00 Data Ultimo Aggiornamento 28/08/26 ore 14:00

Rilevate vulnerabilità in prodotti MongoDB Alert AL04/260813/CSIRT-ITA Sintesi Rilevate cinque vulnerabilità, tra cui una con gravità “critica” e quattro con gravità “alta”, in MongoDB BI Connector ODBC Driver. Tipologia Remote Code Execution Information Disclosure Denial of Service Prodotti e/o versioni affette MongoDB BI Connector ODBC Driver versioni precedenti alla 1.4.9 Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni dei bollettini di sicurezza riportati nella sezione Riferimenti.

Rilevate vulnerabilità in prodotti MongoDB Alert AL06/260812/CSIRT-ITA Sintesi Rilevate molteplici vulnerabilità, tra cui una con gravità “critica” e 16 con gravità “alta”, in MongoDB Server e MongoDB Driver. Tipologia Arbitrary Code Execution Information Disclosure Authentication Bypass Data Manipulation Denial of Service Prodotti e/o versioni affette MongoDB Java Driver, dalla versione 4.11.0 alla 5.9.1 MongoDB Server 7.0.x, versioni precedenti alla 7.0.40 8.0.x, versioni precedenti alla 8.0.29 8.2.x, versioni precedenti alla 8.2.13 8.3.x, versioni precedenti alla 8.3.8 Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni dei bollettini di sicurezza riportati nella sezione Riferimenti.

A now-patched vulnerability in Azure Cosmos DB could have let an attacker escape the service's Gremlin query sandbox and obtain full read and write access to databases across customer tenants, according to Wiz. Wiz, which codenamed the chain CosmosEscape, said the exploit chain began with a crafted query against a Gremlin database controlled by the attacker. From there, code execution on a multi-tenant gateway exposed a platform-wide signing secret and a regional account directory, allowing the researchers to locate a target and retrieve its primary account key. Microsoft blocked the vulnerable Gremlin entry point within 48 hours of the November 2025 report. Wiz said Microsoft completed the longer-term fix across all regions in July 2026 and eliminated the platform-wide key. "We appreciate Wiz's work in identifying and reporting this issue through coordinated vulnerability disclosure," a Microsoft spokesperson told The Hacker News. "We have fully addressed the issue and found no evidence of customer impact based on our investigations. We continue to invest in additional security enhancements across the platform." Microsoft said its review found no unauthorized activity outside the researchers' testing. It said no customer data was accessed and no customer action is required. Wiz told The Hacker News that the only prerequisite was a standard Azure account with a Cosmos DB Gremlin database controlled by the attacker, which could be created in minutes. No special permissions, insider access, or prior foothold were required, and the exploit ran through the attacker's own database query interface. Wiz said the query returned the platform-wide master key. An attacker could then discard the original database and Azure account and use the key over Cosmos DB's public endpoint to retrieve a target account's primary key and take control of its databases. According to Wiz's technical write-up, Cosmos DB's custom Gremlin engine translates Gremlin queries into .NET code and runs them inside a restricted environment. Wiz said the restrictions failed to account for .NET reflection, allowing the researchers to build file-read and file-write primitives before reaching arbitrary code execution. The public disclosure shows the output of a crafted query that executed the hostname command on the Cosmos DB backend, but not the query itself. The researchers said they will present the complete chain at a Black Hat USA briefing on August 6. The code execution landed on a component Wiz calls the DB Gateway, which executes customer queries on multi-tenant Azure Service Fabric clusters. Customer databases were not stored on those clusters, but the gateway could retrieve the primary key for a requested Cosmos DB account. Microsoft documentation says a Cosmos DB account primary key grants full control over all resources in that account. Credentials available to the gateway also provided access to a signing key that Wiz dubbed the Cosmos Master Key. Wiz told The Hacker News that it tested the key against every Cosmos DB API flavor and across several regions, and that it unlocked every account tested. The signing key could retrieve the primary key for accounts across tenants, regions, and the SQL, MongoDB, Cassandra, and Gremlin APIs. The same secret opened a regional database called the Config Store, described by Wiz as a directory containing Cosmos DB account names, subscription and tenant identifiers, network settings, and tags. An attacker could use it to find a specific organization's accounts and then request their primary keys. Wiz told The Hacker News that it ran a count query through the Config Store and verified that one tenant in one region contained thousands of Microsoft-internal databases. It said any broader access described in the report reflected what the key made possible, not actions the researchers took. Wiz said the chain could also reach private and network-isolated accounts because the compromised gateway enforced those network boundaries from inside the service. The researchers' write access to the Config Store suggested network settings could also be changed, although the report does not say they demonstrated that against another customer's account. Microsoft documentation says Teams message data remains in Cosmos DB, while a Microsoft engineering post says Copilot stores users' queries and conversation histories there. Wiz said databases supporting those products were potentially accessible, but it did not report accessing their data. The public record does not say when the vulnerable engine and signing-key path entered production or what period Microsoft's log review covered. The duration of potential exposure therefore remains unknown, although the known path has since been closed. The disclosure lists no CVE identifier or severity score. CosmosEscape is technically separate from the ChaosDB and CosMiss flaws disclosed in 2021 and 2022, which involved Cosmos DB's Jupyter Notebook feature. Update [July 31, 2026]: This story has been updated to include comments from Wiz on the exploit prerequisites, tested scope, and access to Microsoft-internal database records.

Unauthenticated attackers could exploit a critical-severity vulnerability in the open source AI agent orchestration platform Ruflo to execute commands inside the container, Noma Labs security researchers warn. A popular automation assistant with over 67,000 GitHub stars, Ruflo (formerly Claude Flow) comes with a multi-model AI chat interface, agent swarms, persistent memory, and built-in Model Context Protocol (MCP) tool calling. Ruflo allows organizations to use AI applications, courtesy of agent swarms (support for coordinating up to 100 agents on shared enterprise-grade tasks), long-term memory enabling agents to recall past interactions, and an integrated MCP server enabling agents to execute various tasks. “The bridge exposes 233 tools covering shell access, database operations, agent management, and memory storage, making it the single point through which every agent action flows. Because the MCP Bridge requires direct access to the underlying system resources to execute these commands, it creates a high-stakes security boundary,” Noma explains. Tracked as CVE-2026-59726 (CVSS score of 10/10), the security defect was found in the MCP bridge in ruflo/docker-compose.yml, which exposed the POST /mcp endpoint without authentication. Because in default docker-compose deployments the bridge and MongoDB were bound to all interfaces, an unauthenticated attacker could invoke terminal_execute to run commands inside the bridge container, Ruflo’s advisory reads. Successful exploitation of the bug could allow the attacker to gain shell access as node, read provider API keys, spawn swarms on the victim’s keys, and inject poison patterns into the AgentDB learning store to tamper with the AI outputs for all users. According to Noma, which named the bug RufRoot, the root cause is that, in self-hosted deployments, the docker-compose.yml binds port 3001 to 0.0.0.0 by default, exposing all network-reachable instances to exploitation without authentication. “The MCP Bridge isn’t a random auxiliary debug interface; rather, it is Ruflo’s central nervous system. Every tool call, every agent action, every memory operation goes through the MCP Bridge. Mistakenly giving unauthenticated access to the MCP Bridge means giving unauthenticated access to everything,” Noma explains. With a single HTTP request targeting ruflo__terminal_execute, an attacker could take over the agent swarm, because the command would run as the container’s node user, providing access to all accessible assets without further escalation. “Once you have command execution, achieving full compromise is just chaining more requests to the same endpoint,” Noma explains. An attacker could exploit the vulnerability for reconnaissance, remote code execution (RCE), API key and conversation theft, spawning attacker-controlled agent swarms, poisoning the learning pipeline to produce attacker-influenced output, deploying persistent backdoors, and clearing shell history to remove traces. The vulnerability was patched in Ruflo version 3.16.3. The fix addresses all attack vectors, and Ruflo’s maintainers published remediation steps for users with exposed instances. Related: Chrome 151 Patches 370 Vulnerabilities Related: Cisco Secure FMC Zero-Day Exploited in the Wild Related: JFrog Zero-Days Exploited in OpenAI-Hugging Face Hack Related: Critical Arista VeloCloud Orchestrator Vulnerability Exploited as Zero-Day

Cybersecurity researchers have flagged a maximum-severity security flaw in Ruflo, an open-source agent meta-harness for Anthropic Claude Code and OpenAI Codex, that could result in unauthenticated remote code execution. The vulnerability, tracked as CVE-2026-59726 (CVSS score: 10.0), impacts all versions of the project before version 3.16.3. It has been codenamed RufRoot by Noma Security's research team, Noma Labs. Originally launched as Claude Flow, Ruflo is an AI multi-agent orchestration platform and harness that allows users to deploy multi-player swarms, coordinate autonomous workflows, and build conversational AI systems. The project has more than 66,500 stars on GitHub. The crux of the vulnerability is that Ruflo exposed 233 tools, including shell command execution, database operations, agent management, and memory storage, through an unauthenticated Model Context Protocol (MCP) bridge that's open to the network by default. Specifically, the "docker-compose.yml" YAML configuration file was found to bind port 3001 to 0.0.0.0 by default, exposing the bridge on all network interfaces. That said, the extent of exposure depends on the deployment's firewall rules, security groups, and network segmentation. It's worth noting that any network-reachable instance is fully exploitable without authentication. As a result, a single unauthenticated HTTP POST to port 3001 made it possible to gain full remote code execution inside a susceptible Ruflo deployment, per security researcher Eli Ainhorn - curl -s -X POST https:// :3001/mcp -H "Content-Type: application/json" -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"ruflo__terminal_execute","arguments":{"command":"id && hostname"}}}' Armed with this foothold, an attacker could siphon the API keys Ruflo uses to interact with large language model (LLM) providers, read every user conversation stored on the platform, and interfere with the AI system's memory to influence model responses and behavior. In other words, command execution serves as a stepping stone for full compromise, enabling LLM API key theft, agent weaponization, AI memory poisoning, conversation harvesting, and persistent backdoor deployment by writing a malicious payload to the "/app" directory. "Prior to 3.16.3, Ruflo's default docker-compose deployment exposed the MCP bridge POST /mcp and POST /mcp/:group endpoints without authentication, allowing an unauthenticated network attacker to invoke tools/call to terminal_execute, obtain a shell in the bridge container, read provider API keys, and poison AgentDB learning-store patterns," according to a description of the flaw in NIST's National Vulnerability Database (NVD). Following responsible disclosure on June 30, 2026, a fix for the vulnerability was pushed by the project's maintainer, Reuven Cohen, within 24 hours. As part of the patch, the MCP bridge now binds to the loopback interface by default, gates "terminal_execute" behind server-side executeTool controls, and enables MongoDB authentication to prevent conversation theft, among others. "The MCP bridge shipping in ruflo/docker-compose.yml exposed POST /mcp with no authentication," Cohen said in the release notes. "The docker-compose defaults bound the bridge and MongoDB to all interfaces." "Combined, an unauthenticated network attacker could invoke tools/call → terminal_execute inside the bridge container, obtain a shell, read every provider API key from the container env, spawn attacker-controlled swarms on the victim's keys, and persist a poisoned pattern into the AgentDB learning store that steers future AI outputs." Operators running an exposed instance are recommended to immediately close firewall ports 3001 and 27017, rotate all LLM API keys, audit the AgentDB pattern store for injected agentdb_pattern-store entries, and check MongoDB for signs of tampering. "The Ruflo vulnerability enabled spinning up a swarm of agents to do whatever the attacker wanted and even tamper with the AI's memory," Noma said. "The ability to write malicious instructions into a platform's persistent AI memory means an attacker can influence the responses that AI gives to every future user of the platform, long after the original intrusion has ended." "For organizations exposed to a vulnerability like this, remediation requires more than a software update. AI provider credentials should be treated as compromised and rotated, the platform's AI memory should be audited for tampering, and containers should be rebuilt from a clean image."

Rilevate vulnerabilità in prodotti MongoDB Alert AL02/260724/CSIRT-ITA Sintesi Rilevate molteplici vulnerabilità, tra cui una con gravità “critica” e 17 con gravità “alta”, in MongoDB Server e MongoDB Compass. Tipologia Arbitrary Code Execution Data Manipulation Denial of Service Elevation of Privilege Information Disclosure Security Restrictions Bypass Prodotti e/o versioni affette MongoDB Compass dalla versione 1.38.0 alla 1.49.7 MongoDB Server 7.0.x, versioni precedenti la 7.0.39 8.0.x, versioni precedenti la 8.0.28 8.2.x, versioni precedenti la 8.2.12 8.3.x, versioni precedenti la 8.3.7 Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni dei bollettini di sicurezza riportati nella sezione Riferimenti. Di seguito sono riportate le sole CVE relative alle vulnerabilità con gravità “critica” e “alta”:

The open source library holding up your stack might have one maintainer Every serious software product runs on code that someone else wrote and released for free. A web service leans on a cryptography library, a data pipeline pulls in a parser, and a mobile app ships a handful of small utilities that one person maintains in spare time. All of it carries the same label. A new paper argues that the single label hides differences large enough to change how each piece behaves once it lands in production. Researchers sorted open source software into fourteen sub-genres, each defined by who starts and sustains a project and to what end. Their review screened close to four thousand unique papers drawn from two scholarly indexes. The result is a typology, along with an argument that the kind of project a study samples sets how far its conclusions travel. One label covers many kinds of project A community Linux distribution, a single-vendor database, a university research library, a humanitarian health-records system, and a one-person utility differ in why they exist, who decides their direction, and how the work gets paid for. The authors give the differences names. Community-driven projects such as Debian and Arch Linux run on volunteers and merit-based authority. Company-backed projects such as Elastic, MongoDB, and GitLab sit under one firm that earns revenue from the software and controls its roadmap. Foundation-governed projects such as Apache HTTP, Kubernetes, and Eclipse live under a vendor-neutral nonprofit that holds the trademark and keeps competing firms on even terms. Other categories sit further from the usual picture. Multi-company co-opetition covers rivals who build shared infrastructure together, as firms do around OpenStack and the Linux kernel. Research and scientific software gets written inside labs by domain scientists working to grant cycles and academic careers. Protestware covers packages a maintainer alters or sabotages to send a political or economic message, with node-ipc and colors.js as examples. Why the category predicts behavior The practical point lands on funding and governance, since those two things predict how a project holds up once many people rely on it. Critical digital infrastructure is the sharp case. Components such as OpenSSL, curl, and log4j sit underneath much of the software ecosystem, and a few volunteers often keep them running. Nadia Eghbal described this sustainability problem in a Ford Foundation report, and later research formalized it as underproduction, a state where the labor a component receives falls short of how widely it is relied upon. Studies of the npm ecosystem show a related risk, where a small number of maintainer accounts reach much of the network. Hobbyist and solo projects carry the same fragility. Researchers call this a low truck factor, which is a way of asking how many people would have to walk away before the whole thing grinds to a halt. For a one-person project, the answer is one. When that maintainer gets busy, burns out, or moves on, the code stops moving with them. A project backed by a foundation with member dues and paid staff has more people to lean on when the same thing happens. The community itself differs too The differences run deeper than money. Take open source for social good, or OSS4SG, the projects built to help people rather than turn a profit, things like the health-records system OpenMRS or the crisis-mapping tool Ushahidi. People who show up to these projects tend to stay. The authors call them “sticky.” Conventional projects are “magnetic,” pulling in a crowd where plenty pass through and move on. The road from first-time contributor to trusted core member looks different too, and in OSS4SG people reach that core faster and by more than one path. So a playbook for keeping contributors around, built on one kind of project, can fall flat on another. Where the category leaves off For anyone who works in IT, this lands close to home. The typology is still a work in progress, a light review the authors treat as a starting hypothesis, so the categories will shift as more research comes in. The practical read holds up anyway. Before your org commits to an open-source tool or pulls in a new dependency, the category tells you something a star count never will. An open-core product from a single vendor comes with relicensing risk tied to that vendor’s business plans. A solo package comes with bus-factor risk, the odds that one person walking away breaks it. A foundation-backed project comes with the governance that lets competitors share it in the first place. Knowing what kind of project you are dealing with puts the risk in plain sight before the code ever ships. Must read: 20 open-source cybersecurity tools to keep your team ready for anything GitHub CISO on security strategy and collaborating with the open-source community Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!

MongoDB heeft meerdere kwetsbaarheden verholpen in MongoDB Server. De kwetsbaarheden betreffen verschillende onderdelen van MongoDB Server. Een kwetsbaarheid in de loggingmechanismen kan ertoe leiden dat volledige authenticatiegegevens, inclusief gevoelige credentials, zonder redactie worden vastgelegd in serverlogs tijdens SASL-authenticatiesessies. Een andere kwetsbaarheid in de BSON-validatie veroorzaakt een crash van het mongod-proces door onbeheersbare wederzijdse recursie bij de validatie van geneste binaire data, wat resulteert in een denial-of-service.

Breaches don't always start with a zero-day. An exposed admin panel can get brute-forced, or credentials reused from a previous attack. But when a vulnerability does drop — like MongoBleed earlier this year, which let attackers pull credentials and session tokens from server memory without authentication — anything internet-facing is immediately at risk. With time-to-exploit now down to a single day, the question isn't just how fast you can patch. It's why the service was exposed in the first place. The team at Intruder analyzed 3,000 attack surfaces to find out how much of a typical organization's attack surface consists of services that have no reason to be there. We grouped what we found into four categories — HTTP panels, risky ports and services, databases, and publicly accessible files and information. The full findings, including breakdowns by company size and industry, are in our 2026 Attack Surface Management Index. How widespread is the problem? 60% of organizations had at least one HTTP panel exposed — admin consoles, management UIs, login pages for internal tools that have no business being publicly reachable. Nearly half (49%) had a risky port or service exposed. 42% had a database reachable directly from the internet. 30% had files or information publicly accessible that shouldn't be — API documentation, config files, data that was never intended to be discoverable. The ten most common exposures These are the most common attack surface exposures affecting organizations in the past 12 months. MySQL Database Exposed — 26% Postgres Database Exposed — 16% API Documentation Exposed — 15% WordPress Admin Panel Exposed — 15% Remote Desktop Service Exposed — 11% SNMP Service Exposed — 9% phpMyAdmin Admin Panel Exposed — 8% UPnP Service Exposed — 8% NTP Service Exposed — 7% RPC Portmapper Service Exposed — 7% Databases dominate the top two spots Exposed databases take the top two spots, with more than a quarter of organizations exposing MySQL and Postgres, affecting 1 in 6. Internet-facing databases have long been a target for opportunistic attackers. The PLEASE_READ_ME ransomware campaign in 2020 compromised more than 250,000 MySQL databases by brute-forcing weak credentials. MongoDB and Elasticsearch have faced the same. API documentation is more exposed than RDP API documentation ranked third — ahead of RDP, which surprised us. Some API docs are intentionally public, but organizations frequently overlook documentation tied to private or admin-side APIs that were never meant to be discoverable. Public API docs can turn otherwise hard-to-find vulnerabilities into documented attack paths. RDP remains a ransomware entry point RDP at number five is a concern given its history as an initial access vector in ransomware attacks. BlueKeep in 2019 left nearly a million systems immediately exploitable. Credential guessing against exposed RDP remains one of the most reliable ways ransomware operators get in. The rest of the list was never meant to be internet-facing The remainder of the list — SNMP, UPnP, NTP, RPC — are legacy services designed for internal networks that were never meant to be internet-facing. Get the full findings Most teams treat patching as the priority. But for a lot of what's on this list — databases, admin panels, legacy services — the better question is why they're reachable at all. That's where attack surface reduction comes in — and for most organizations, it's not getting the same attention as vulnerability management. The full findings, including breakdowns by company size and industry, are in the 2026 Attack Surface Management Index.

Rilevata vulnerabilità in MongoDB Alert AL02/260612/CSIRT-ITA Sintesi Rilevata una nuova vulnerabilità in MongoDB Server con gravità “alta”. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un utente malintenzionato di accedere ad informazioni sensibili e di compromettere la disponibilità del servizio sui sistemi interessati. Tipologia Denial of Service Information Disclosure Prodotti e/o versioni affette MongoDB Server 8.3.x, versione 8.3.3 e precedenti 8.2.x, versione 8.2.10 e precedenti 8.0.x, versione 8.0.25 e precedenti 7.0.x, versione 7.0.36 e precedenti 6.0.x, versione 6.0.28 e precedenti 5.0.x, versione 5.0.33 e precedenti 4.4.x, versione 4.4.30 e precedenti Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni del bollettino di sicurezza riportato nella sezione Riferimenti.

Rilevate vulnerabilità in MongoDB Alert AL14/260610/CSIRT-ITA Sintesi Rilevate molteplici vulnerabilità in MongoDB Server di cui 12 con gravità “alta”. Tali vulnerabilità potrebbero consentire l’accesso a informazioni sensibili, l’alterazione dei dati, l’elusione dei meccanismi di sicurezza e/o la compromissione della disponibilità del servizio sui sistemi interessati. Tipologia Data Manipulation Denial of Service Information Leakage Security Restrictions Bypass Prodotti e/o versioni affette MongoDB Server (Major Releases) 8.0.x, versioni precedenti la 8.0.24 7.0.x, versioni precedenti la 7.0.35 MongoDB Server (Feature / Rapid Releases) 8.3.x, versioni precedenti la 8.3.3 8.2.x, versioni precedenti la 8.2.10 Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni dei bollettini di sicurezza riportati nella sezione Riferimenti. Di seguito sono riportate le sole CVE relative alle vulnerabilità con gravità “alta”:

Monday recap. Same mess, new week. A sketchy dev tool got people pwned, old bugs came back from the dead, and security products somehow needed protecting from themselves. A bunch of companies spent the week checking old boxes and forgotten servers they should've patched years ago. Good times. Phishing crews are getting smarter too - less obvious scam junk, more targeted stuff that actually looks real. Meanwhile, botnets are grabbing anything exposed to the internet like it's free candy. The Internet's still a dumpster fire. Let’s get into it. ⚡ Threat of the Week GitHub Breached via Nx Console VS Code Extension—GitHub officially confirmed that the breach of its internal repositories was the result of a compromise of an employee device involving a poisoned version of the Nx Console Microsoft Visual Studio Code (VS Code) extension. The attack is said to have allowed the threat actor, a cybercriminal group known as TeamPCP, to exfiltrate about 3,800 repositories. GitHub said it has taken steps to contain the incident and rotated critical secrets, adding it's continuing to monitor the situation for follow-on activity. The Nx team revealed that the extension, nrwl.angular-console, was breached after one of its developers' systems was hacked in the wake of the recent TanStack supply chain attack. Other companies that were impacted by the TanStack compromise include OpenAI, Mistral AI, and Grafana Labs. Grafana Labs was also the target of an extortion attempt, but the company said it refused to pay the hackers who had threatened to release the company's codebase. The incidents are just some examples of the long tail of downstream victims emerging from the Mini Shai-Hulud campaign. This, coupled with TeamPCP's public release of the Shai-Hulud code, marks a significant evolution in software supply chain threats, as it gives attackers a ready-made blueprint for fleshing out similar worms targeting open-source repositories and developer environments. 80% of Security Teams Know OAuth Security Is Urgent. Half Are Doing Nothing Manual OAuth reviews don’t scale, and the rapid adoption of AI agents is making it worse. Material’s OAuth Threat Remediation Agent continuously monitors every connection across your cloud workspace, classifies risk, and automatically kills malicious ones before they become incidents. Close the Gap Today ➝ 🔔 Top News Microsoft Took Down Fox Tempest—Microsoft has cracked down on Fox Tempest, a cyber threat actor that fueled Rhysida ransomware attacks and other infections involving Oyster, Lumma Stealer, and Vidar. The group operates upstream in the malware and ransomware supply chain, acting as an enabler and providing tools for other threat actors to carry out attacks. This included a fraudulent code-signing service that let cybercriminals deploy malware "through the front door" without being detected. While bad actors have been known to resell code-signing certificates for at least a decade, Fox Tempest's operation stood out because it provided a scalable service for extortion, phishing, SEO poisoning, or malware-laced advertising. 9-Year-Old Linux Kernel Flaw Enables Root Command Execution—A new vulnerability disclosed in the Linux kernel remained undetected for nine years. The vulnerability, tracked as CVE-2026-46333 (CVSS score: 5.5), is a case of improper privilege management that could permit an unprivileged local user to disclose sensitive files and execute arbitrary commands as root on default installations of several major distributions like Debian, Fedora, and Ubuntu. The issue was introduced in November 2016. Microsoft Warned of Two Actively Exploited Defender Vulnerabilities—Microsoft has disclosed that a privilege escalation and a denial-of-service flaw in Defender have come under active exploitation in the wild. While CVE-2026-41091 could allow an attacker to gain SYSTEM privileges, CVE-2026-45498 relates to a case of denial-of-service. Although Microsoft has not formally confirmed, the vulnerability descriptions for CVE-2026-41091 and CVE-2026-45498 overlap with those of RedSun and UnDefend, two Defender zero-days that were disclosed by Chaotic Eclipse (aka Nightmare-Eclipse) last month. Newly Disclosed Drupal Core Flaw Under Attack—A critical security flaw impacting Drupal Core has come under active exploitation within days of public disclosure. The vulnerability in question is CVE-2026-9082 (CVSS score: 6.5), an SQL injection vulnerability affecting all supported versions of Drupal Core. Drupal acknowledged that "exploit attempts are now being detected in the wild." Thales-owned Imperva said it has observed over 15,000 attack attempts targeting almost 6,000 individual sites across 65 countries. Claude Mythos AI Finds 10K High-Severity Flaws in Popular Software—Anthropic revealed that Project Glasswing has helped uncover more than 10,000 high- or critical-severity vulnerabilities across some of the most "systemically" important software across the world since the cybersecurity initiative went live last month. Of these vulnerabilities, 6,202 have been classified as high- or critical-severity flaws impacting more than 1,000 open-source projects. Subsequent analysis of these vulnerability candidates has identified that 1,726 are valid true positives. As many as 1,094 flaws are assessed to be either high- or critical-severity. In total, these efforts have led to 97 findings being patched upstream and 88 advisories being issued. Cisco Patched CVSS 10.0 Secure Workload Flaw—Cisco rolled out updates for a maximum-severity security flaw impacting Secure Workload that could allow an unauthenticated, remote attacker to access sensitive data. Tracked as CVE-2026-20223 (CVSS score: 10.0), the vulnerability arises from insufficient validation and authentication when accessing REST API endpoints. "An attacker could exploit this vulnerability if they are able to send a crafted API request to an affected endpoint," Cisco said. "A successful exploit could allow the attacker to read sensitive information and make configuration changes across tenant boundaries with the privileges of the Site Admin user." Microsoft Released Mitigations for YellowKey—Microsoft released a mitigation for a BitLocker bypass vulnerability named YellowKey following its public disclosure last week. The zero-day flaw, now tracked as CVE-2026-45585, carries a CVSS score of 6.8. It has been described as a BitLocker security feature bypass. The issue impacts Windows 11 version 26H1 for x64-based Systems, Windows 11 Version 24H2 for x64-based Systems, Windows 11 Version 25H2 for x64-based Systems, Windows Server 2025, and Windows Server 2025 (Server Core installation). Microsoft noted that successful exploitation could permit an attacker with physical access to sidestep the BitLocker Device Encryption feature on the system storage device and gain access to encrypted data. 🔥 Trending CVEs Bugs drop weekly, and the gap between a patch and an exploit is shrinking fast. These are the heavy hitters for the week: high-severity, widely used, or already being poked at in the wild. Check the list, patch what you have, and hit the ones marked urgent first — CVE-2026-48172 (LiteSpeed User-End cPanel Plugin), CVE-2026-34926 (Trend Micro Apex One), CVE-2026-20223 (Cisco Secure Workload), CVE-2026-41091, CVE-2026-45498, CVE-2026-45584 (Microsoft Defender), CVE-2026-46333 (Linux Kernel), CVE-2026-9082 (Drupal Core), CVE-2026-45585 (Microsoft Windows BitLocker), CVE-2026-2743 (SEPPMail), CVE-2026-7301, CVE-2026-7302, CVE-2026-7304 (SGLang), CVE-2026-29205 (cPanel), CVE-2026-8178 (Amazon Redshift JDBC driver), CVE-2026-8053 (MongoDB), CVE-2026-45829 aka ChromaToast (ChromaDB), CVE-2026-8153 (Universal Robots PolyScope 5), CVE-2026-3102 (ExifTool), CVE-2026-9110, CVE-2026-9111, from CVE-2026-8511 through CVE-2026-8522 (Google Chrome), CVE-2026-45434 (Apache OFBiz), CVE-2026-33000, CVE-2026-34908, CVE-2026-34909, CVE-2026-34910, CVE-2026-34911 (UniFi OS), CVE-2026-45401 (Open WebUI), CVE-2026-9256, CVE‑2026‑8711 (F5 NGINX Plus and NGINX Open Source), CVE-2026-20239 (Splunk Enterprise and Splunk Cloud Platform), CVE-2026-46376 (FreePBX), CVE‑2026‑6637 (PostgreSQL), and CVE-2026-35194 (Apache Flink). 🎥 Cybersecurity Webinars Learn How Attackers Use AI to Supercharge DDoS Efficiency (and How to Stop It) → Adversaries are weaponizing AI to exploit network blind spots, auto-generate evasion scripts, and bypass traditional defenses with surgical precision. This webinar bridges the gap between AI-driven exploitation and cloud resilience, offering data-driven insights into how attackers maximize DDoS success rates. Join us to move beyond theory, leverage AI for non-disruptive security testing (CTEM), and transition your team from reactive mitigation to automated, continuous resilience. Beyond the Zero-Day: Hunting for Threats That Don't Need an Exploit → Zero-day exploits are no longer the ultimate metric of cyber risk. Today, sophisticated adversaries bypass traditional defenses entirely by leveraging identity flaws, living-off-the-land techniques, and AI automation that don't rely on unpatched software. This session moves beyond the zero-day obsession to expose how attackers operationalize modern post-compromise tactics—and how security teams can pivot from reactive patching to proactive, behavioral threat hunting. 📰 Around the Cyber World Vulnerability Exploitation Overtakes Compromised Credentials in a Long Time —Vulnerability exploitation has overtaken compromised credentials for the first time in nearly two decades as the most common initial access vector for data breaches, per Verizon. Nearly a third (31%) of data breaches over the past year started with vulnerability exploitation, up from 20% in 2024. Credential abuse declined from 22% to 13%. What's more, only 26% of critical vulnerabilities listed in the U.S. Cybersecurity Infrastructure and Security Agency Known Exploited Vulnerabilities (KEV) catalog were fully remediated by organizations in 2025, a drop from 38% the previous year. "The median time for full resolution went up to 43 days, almost two weeks more than the previous year’s 32 days," the report said. "In the median case, organizations had 50% more critical vulnerabilities to patch in this year’s reporting dataset compared to the previous year." Ransomware accounted for 48% of all breaches last year, up from 44% in 2024. But in a positive development, ransom payments have continued to decline, with the median payment sliding from $150,000 in 2024 to almost $140,000. Attackers Go After India's Education Ecosystem —Threat actors are abusing student data within India's education ecosystem, spanning educational institutions, third-party vendors, and online services, for phishing, impersonation, social engineering, and financially motivated fraud operations. "Attackers commonly leverage exposed or misused student information to create highly convincing scams related to admissions, scholarships, internships, fee payments, and academic services," CYFIRMA said. "In several instances, threat actors exploited trusted educational branding, fraudulent portals, and insider access to obtain credentials, financial information, or direct payments. Additionally, some cases indicated the misuse of student-linked bank accounts within broader fraud and mule account operations." RondoDox Adds ASUS Router Flaw to its Arsenal —The operators of the RondoDox botnet have incorporated CVE-2018-5999 (CVSS score: 9.8), a critical ASUS router flaw, to their arsenal, marking the first observation of in-the-wild exploitation of the vulnerability. The activity was first detected on May 17, 2026, against its honeypots. "The attack pattern: payloads that set the ateCommand_flag to 1, enabling the infosvr interface to accept arbitrary configuration changes," VulnCheck CTO Jacob Baines said in a post on LinkedIn. Fake Microsoft Teams Sites Deliver ValleyRAT —Fake Microsoft Teams distribution sites shared on X are being used to trick unsuspecting users into downloading a trojanized installer packaged as a ZIP archive, ultimately leading to the deployment of ValleyRAT, a malware associated with a Chinese cybercrime group called Silver Fox. "The delivered payload leverages a DLL sideloading chain via a legitimate executable (GameBox.exe) developed by Tencent, ultimately deploying a ValleyRAT variant," K7 Labs said. "This malware campaign stands out for its clean execution chain, combining social engineering with staged payload delivery, in-memory decryption, and stealthy persistence mechanisms." Malicious Activity Targeting Malaysian Entities —An attacker-controlled infrastructure hosted on Microsoft Azure infrastructure in the Malaysia West region has been used to conduct a targeted intrusion campaign against multiple Malaysian organizations, per Oasis Security. "The operation demonstrates a high degree of operational planning, with the attacker developing purpose-built Python tooling for each target — covering internal network enumeration, database access, and external data exfiltration," the company said. The infrastructure hosts target-specific Python scripts, webshell deployment tools, a Laravel remote code execution exploit chain, and source code for custom command-and-control (C2) components. Texas Attorney General Sues Meta Over WhatsApp Encryption Claims —The Texas Attorney General has sued Meta over allegations that the company's WhatsApp messenger doesn't provide the end-to-end encryption (E2EE) it has long claimed. "Reports suggest that employees of WhatsApp have been able to access user communications," the Office of the Texas Attorney General said. "Additional reporting and investigations indicate that message content can be pulled and viewed after the message has been sent. This is a complete and total misrepresentation of Meta’s privacy policies." The lawsuit hinges on a report from Bloomberg from last month about how the U.S. Commerce Department's Bureau of Industry and Security had abruptly closed an investigation into allegations that Meta could access encrypted WhatsApp messages. Preliminary findings from the department claimed that "there is no limit to the type of WhatsApp message that can be viewed by Meta." Meta has called the allegations "baseless." FIOD Arrests Two in Connection with Stark Industries —The Netherlands Fiscal Intelligence and Investigation Service (FIOD) arrested two men and seized 800 servers in connection with a web hosting company that enabled cyber attacks, interference operations, and disinformation campaigns. The arrested individuals included a 57-year-old man from Amsterdam and a 39-year-old man from The Hague. Although the name of the company was not explicitly mentioned, it is assessed to be Stark Industries, which was sanctioned by the E.U. in May 2025. Following the sanctions, a significant chunk of the technical infrastructure was transferred to a Dutch-based entity known as THE.Hosting aka WorkTitans. "This new company actually acts as a cover for the sanctioned entities," FIOD said. "The director and (indirect) sole shareholder of this company is the 57-year-old suspect." A second unnamed Dutch company is said to have played a facilitating role. "This company, of which the 39-year-old is a suspected director and sole shareholder, ensures that the servers of the former new company are connected to the internet," FIOD added. UNG0002 Targets Chinese Educational Sector —The Chinese educational sector has become the target of a new campaign conducted by UNG0002 as part of a spear-phishing campaign codenamed Operation Dragon Whistle. "What makes this campaign particularly effective is the precision of its social engineering," Seqrite Labs said. "The threat actor did not use a generic lure — they specifically identified that Changzhou University conducts mandatory annual fitness assessments where failure directly impacts graduation eligibility. This creates an environment of urgency and compliance that significantly increases the probability of victim engagement." The emails have been found to distribute ZIP archives that ultimately lead to the deployment of Cobalt Strike Beacon. Void Botnet Uses Ethereum Smart Contracts for C2 —A new botnet malware called Void Botnet uses Ethereum smart contracts for seizure-resistant command-and-control (C2). It's a Rust-based malware that's advertised on cybercrime forums by a developer operating under the handle TheVoidStl. "Based on the seller's documentation and panel screenshots, Void Botnet is a Rust-native loader with two command-and-control modes in the same binary," Qrator Labs said. "The first mode routes commands through Ethereum smart contracts: the operator writes instructions to a contract, and infected machines check it at regular intervals, picking up new tasks within three to five minutes. The second mode connects machines directly to the operator's web panel, with tasks completing in under thirty seconds. The operator switches between them at any time by updating the contract." The botnet works by writing commands to smart contracts, bots polling public RPC endpoints, and C2 infrastructure that is hard to take down. Proton Debuts AI Access Tokens in Proton Pass —Proton Pass, a secure, end-to-end encrypted (E2EE) password manager, has added credential sharing through AI access tokens, allowing users to give AI agents access to items it's permissioned to and monitor their activity. "AI access tokens are our newest secure sharing option to bring password management into the age of agentic AI," Proton said. "Every time an AI agent uses an access token, this is logged, and a reason for the access must be provided. For extra security, you can also set an expiration for each token, from one hour to one year, after which it can no longer be used." DevilNFC and NFCMultiPay Android NFC Relay Malware Spotted —Two new Android NFC relay malware families named DevilNFC and NFCMultiPay have been observed targeting European and LATAM banking customers. "These two NFC relay toolkits are being developed and operated outside the Chinese-speaking MaaS ecosystem: DevilNFC carries an exclusively Spanish-speaking attribution, while NFCMultiPay's developer fingerprint is Portuguese (Brazilian)," Cleafy said. "Local groups are no longer buying access to Chinese platforms; they are building their own." It's assessed that the malware families may have been developed with assistance using generative artificial intelligence (AI). Both malware families are designed to collect the victim's card PIN. "DevilNFC further locks the victim inside the malicious interface via Kiosk Mode, preventing any escape while the relay completes," the Italian company said. "DevilNFC employs an asymmetric architecture in which a single APK serves both roles in a relay attack: a passive reader on the victim's device and a system-level card emulator on the attacker's rooted device, achieved via a hooking framework that intercepts NFC traffic below the Android API layer." DevilNFC overlaps with an NGate variant documented by ESET last month. The malicious apps are distributed via SMS or WhatsApp messages, directing victims to fake landing pages impersonating Google Play Store listings. TAX#TRIDENT Uses Indian Income Tax Lures —A new campaign dubbed TAX#TRIDENT is using Indian Income Tax-themed lures to target Windows endpoints via three delivery paths. The campaign starts with fake tax assessment lures and then moves victims toward ZIP files, VBScript downloaders, or PHP-looking web endpoints that actually return script content," Securonix said. "The first branch uses a ZIP file and a signed ClientSetup installer. Once executed, the installer creates a hidden client tree, adds service and driver persistence, and starts network communication. The second branch uses 'Assessment_Order.vbs.' The script shows a tax assessment decoy image, downloads the same ClientSetup payload, writes a new 'YTSysConfig.ini,' and runs the payload hidden. The third branch uses a PHP-looking endpoint that returns VBScript. That script downloads more stages from S3, disguises a VBS file as a PNG image, changes UAC prompt behavior, and silently installs a signed ManageEngine UEMS / Endpoint Central agent." CISA Launches KEV Nomination Form to Report Exploited Bugs —The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has introduced an online Nomination Form that lets researchers, vendors, and industry partners submit known exploited vulnerabilities (KEVs) directly so as to "quickly identify, validate, and share KEVs, critical threat information." Exploitation of Four-Faith Router Flaw —Attackers are exploiting CVE-2024-9643 (CVSS score: 9.8), a critical authentication bypass flaw in Four-Faith F3x36 industrial cellular routers, as part of a large-scale campaign since mid-May 2026 to turn fold compromised devices into botnets for further campaigns. CrowdSec said it has observed 139 attacking IP addresses through May 18, 2026. "Exploitation was first observed on April 20 and escalated to the point of being reclassified as mass exploitation on May 12, a strong signal that attackers are operationalizing this flaw at scale," it added. Chinese-Language PhaaS Ecosystem Detailed —An analysis of a dozen current phishing-as-a-service (PhaaS) offerings in the Chinese underground has found that they have shifted away from static password harvesting towards real-time interception and tokenization via live administration panels, allowing attackers to capture one-time passcodes (OTPs) and bypass multifactor authentication (MFA) instantly. The services, such as YY Lai Yu, primarily target non-Chinese entities, with advertisements regularly posted to Telegram rather than channels such as WeChat (Weixin) or Tencent QQ. A crucial aspect of these operations is their exploitation of digital wallet provisioning to monetize stolen payment details. Attackers have been found to leverage captured credentials and OTPs to provision the victim's card into a digital wallet on an attacker-controlled device. Once tokenized, the card can be used for high-value transactions, contactless payments, and ATM withdrawals. "Instead of simply gaining account access, these operations focus on exploiting digital wallet provisioning to transform stolen payment data into tokenized assets within ecosystems," Google said. "This shift—combined with the use of encrypted delivery channels like RCS and iMessage to bypass traditional carrier security filters on SMS messages—represents an emerging development where the goal is no longer just a login, but securing direct, unauthorized control over a victim's financial accounts." 🔧 Cybersecurity Tools Bumblebee → It is an open-source security tool for macOS and Linux designed to find software supply-chain vulnerabilities on developer computers. It acts as a lightweight, read-only scanner that audits metadata files, manifests, and configurations rather than executing code. This allows it to safely check local language packages, web browser extensions, text editor add-ons, and AI tool configurations for known security exposures without running potentially malicious install scripts. Claude-BugHunter → It is an open-source add-on that configures Anthropic’s Claude Code command-line tool into a specialized security assistant. It equips the AI with pre-built vulnerability patterns, attack techniques, and reporting templates, automating the process of finding and documenting security flaws during authorized testing. Disclaimer: This is strictly for research and learning. It hasn't been through a formal security audit, so don't just blindly drop it into production. Read the code, break it in a sandbox first, and make sure whatever you’re doing stays on the right side of the law. Conclusion Patch the easy stuff before it becomes a bigger problem next week. The old bugs everyone ignored? Attackers didn’t ignore them. They never do. Right now, the internet feels held together with tape and luck. Every week, there’s a new mess, a new scam, or some old box getting dragged into a botnet. See you next Monday.

Encryption Consulting launches CertSecure Manager v3.3 with zero-touch certificate renewals Encryption Consulting has released CertSecure Manager v3.3, which automates zero-touch certificate renewal across all major enterprise server platforms and extends CA support to 11 providers, including Google Public CA and AWS. Certificate-related outages can cost enterprises millions in unplanned downtime, and expired or misconfigured certificates often cause serious security incidents. CertSecure Manager v3.3 closes both gaps, removing the manual steps that introduce costly renewal errors. “With v3.3, we have made zero-touch certificate renewal a reality across every major server platform, and paired that with automated risk intelligence so security teams know exactly which certificates pose a threat before an incident ever occurs,” said Puneet Singh, Principal, Encryption Consulting. “Certificate-related outages and blind spots should be a thing of the past.” What’s new in v3.3 Zero-touch renewal across all major web, load balancer and database platforms: Automated renewal agents now cover Apache, Nginx, IIS, F5, Citrix NetScaler, JBoss EAP, Wildfly, MongoDB, Oracle DB and MSSQL Server. No human intervention is required at renewal time, eliminating the class of outages caused by missed or failed manual renewals. Google Public CA integration: CertSecure Manager v3.3 is among the first CLM platforms to deliver native lifecycle management for Google Public CA. Combined with existing support for Microsoft AD CS, Digicert, Entrust, EJBCA, HashiCorp Vault and AWS Public and Private CA, the platform now covers 11 CAs from a unified console, giving organizations the flexibility to add CA licenses as needed without depending on a single provider. Certificate risk profile engine: Every certificate in the inventory is automatically classified for risk, based on key strength, algorithm and validity period, giving security teams a prioritized view of exposure without manual audits. ServiceNow store app: CertSecure Manager is now available directly in the ServiceNow Store, and integrates with Splunk SIEM, embedding certificate lifecycle management directly into the organization’s IT and security operations tools. Certificate trust chain visualization: Administrators can now view and download the full certificate chain relationship directly in the CertSecure UI without external tooling, reducing investigation time during incidents. Expanded discovery: AWS Cloud Discovery, IIS CCS Store Discovery, container discovery and vault discovery close inventory blind spots across cloud and on-premises environments. Third-party certificate container ingestion ensures that no certificate goes untracked. Bulk operations and infrastructure observability: Bulk Revocation and Bulk Ownership Transfer reduce operational effort during organizational changes or large-scale certificate incidents. New System Metrics Monitoring provides real-time CPU, disk and RAM data per CertSecure component from within the CLM dashboard. Ansible ACME desired state management: Infrastructure-as-code teams can enforce certificate compliance automatically through the Ansible ACME module, integrating CLM directly into DevOps pipelines without added tooling.

Since the last update, the TeamPCP supply chain campaign produced its loudest stretch since the March Trivy disclosure: an officially confirmed Checkmarx Jenkins plugin compromise and a new self-spreading Mini Shai-Hulud worm across npm and PyPI. Bottom line up front Two TeamPCP events broke within 48 hours of each other and doubled attention on the campaign. Checkmarx confirmed its Jenkins AST plugin was trojanized, its third compromise in three months, validating an earlier single-researcher claim. In parallel, a new Mini Shai-Hulud worm poisoned roughly 170 npm and PyPI packages (42 @tanstack packages in about six minutes, downloads above 500 million) and was the first documented npm malware shipping with valid SLSA Build Level 3 provenance, plus a 1-in-6 disk-wipe payload on Israeli and Iranian locale hosts. NHS England issued the campaign's first government alert; CISA stayed silent. Action: audit CI for the indicators below, stop trusting provenance alone, pin and lockfile-verify dependencies. How this developed The period opened quiet and derivative: the lead story was PCPJack, a rival worm that evicts TeamPCP before stealing credentials, alongside a single-researcher claim that a Checkmarx Jenkins plugin had been backdoored. Days later it turned loud: Checkmarx officially confirmed that exact Jenkins compromise, and a new Mini Shai-Hulud worm hit the npm and PyPI ecosystems hard. The through-line is escalation: an unconfirmed rumor became a confirmed incident, and the campaign moved from a quiet competitor-eviction story to a high-impact, signed-malware supply chain wave. What changed, by theme Checkmarx Jenkins plugin: an unconfirmed claim, then official confirmation Takeaway: a single-researcher claim, explicitly logged as unconfirmed at the time, was confirmed by Checkmarx four days later. On 2026-05-09, researcher Berk Albayrak reported on X that the Checkmarx Jenkins AST scanner plugin had been backdoored. No Tier 1 outlet, no vendor, and no Checkmarx statement corroborated it at the time, so it was carried as information-only pending confirmation. On 2026-05-11 Checkmarx published an official update acknowledging that a tampered plugin (version 2026.5.09) had been published to the Jenkins Marketplace, with an exposure window of 2026-05-09 01:25 UTC to 2026-05-10 08:47 UTC. The Register, BleepingComputer, SecurityWeek, and The Hacker News carried it the same day. This is the third TeamPCP compromise of Checkmarx in three months, and the malicious plugin was installed by several hundred Jenkins controllers. Last known-good build: 2.0.13-829.vc72453fa_1c16 (2025-12-17). Remediated builds (both 2026-05-09): 2.0.13-848.v76e89de8a_053 and 2.0.13-847.v08c0072b_2fd5. The Mini Shai-Hulud TanStack wave Takeaway: a self-spreading worm poisoned roughly 170 npm and PyPI packages, and the publishes came from TanStack's own trusted release pipeline. Starting 2026-05-11 at 19:20 UTC, the worm published 84 malicious artifacts across 42 @tanstack npm packages in about six minutes, including @tanstack/react-router (roughly 12 million weekly downloads). It then propagated to Mistral AI, UiPath, OpenSearch, Guardrails AI, and roughly 170 packages across npm and PyPI, with combined cumulative downloads above 500 million. Primary technical disclosures came from Wiz and StepSecurity, with Snyk and BleepingComputer adding scope and counts. The tracking identifier is CVE-2026-45321 (CVSS 9.6 per The Hacker News; advisory GHSA-g7cv-rxg3-hmpx per Snyk; Wiz and StepSecurity did not assign a CVE). A reported operator error matters for defenders: per Wiz's 2026-05-13 update, the credential stealer is non-functional in the @uipath and @mistralai variants because the payload is reassembled incorrectly there, which limits the harvest from the largest non-TanStack targets. Signed malware: the SLSA Build Level 3 first Takeaway: this is the first documented npm supply chain attack shipping malware with valid SLSA Build Level 3 provenance, so "has provenance" no longer means "not malicious." Per Wiz, StepSecurity, and Snyk, the malicious versions carried valid SLSA Build Level 3 provenance attestations. Analysts assess this is novel and material: the attacker never stole maintainer npm credentials. Instead the malicious versions were published by TanStack's legitimate release pipeline using its own trusted OIDC identity, so the provenance is genuine and proves only that TanStack's pipeline built the artifact, not that the artifact is safe. The practical consequence: provenance and attestation checks alone do not detect this class of attack. Pinning exact versions and verifying lockfile hashes against a known-good baseline are still required. Destructive and persistent: a 1-in-6 wipe and AI-agent persistence Takeaway: this wave added a sabotage payload and a developer-tool persistence mechanism not seen in earlier Mini Shai-Hulud waves. BleepingComputer (Bill Toulas) reported a probabilistic sabotage mechanism with a 1-in-6 chance of running a recursive wipe on systems matching Israeli or Iranian locales, a new behavior class for this malware family. Expel reported that the worm injects persistence hooks into developer tooling, specifically .vscode/tasks.json and ~/.claude/settings.json, so it survives reboots on developer endpoints. Defenders in the affected regions should treat the wipe behavior as a credible data-loss risk, and all teams should inspect those two file locations on engineer machines. This destructive, geopolitically-targeted behavior is not new to the campaign. The original TeamPCP campaign report documented a conditional wiper in the earlier CanisterWorm payload that checked whether the infected system's timezone was set to Iran or its default language was Farsi, and on a match attempted to destroy data, wiping Kubernetes clusters node by node, or the local machine if no cluster was found. The current mechanism is a different payload and uses a probabilistic 1-in-6 trigger rather than a deterministic locale check, but it continues the same documented pattern of region-targeted data destruction layered onto a credential-theft operation. PCPJack: a rival worm evicting TeamPCP Takeaway: the first publicly documented actor to hunt and remove TeamPCP before stealing credentials, assessed with moderate confidence as a former affiliate. On 2026-05-07 SentinelLABS disclosed PCPJack, a cloud worm that scans for exposed Docker, Kubernetes, Redis, MongoDB, and RayML services, exploits five vulnerabilities for initial access (CVE-2025-29927 Next.js middleware authentication bypass, CVE-2025-55182 Next.js Server Actions deserialization, CVE-2026-1357 WPVivid arbitrary file upload, CVE-2025-9501 W3 Total Cache RCE, CVE-2025-48703 CentOS Web Panel command injection), then kills TeamPCP processes and removes TeamPCP artifacts before harvesting npm, GitHub, and cloud credentials. SentinelLABS assesses with moderate confidence that PCPJack may be operated by a former TeamPCP affiliate, based on tradecraft overlap with the December 2025 PCPCat phase. BleepingComputer, SecurityWeek, and The Register covered it within 36 hours. A follow-up on 2026-05-13 continued the PCPJack story. Monetization stays frozen: Vect and CipherForce Takeaway: the affiliated extortion channels stayed inactive through the period, supporting the view that TeamPCP's ransomware monetization is impaired. Direct fetches of the ransomware.live Vect tracker show the victim count unchanged at 25, with the most recent posting dated 2026-04-15, leaving Vect operationally quiet for roughly 32 days by 2026-05-15. CipherForce remained inactive at roughly 84 days, with 6 victims unchanged. Combined with the earlier Check Point disclosure of a cryptographic flaw in Vect 2.0, this reinforces the prior assessment that TeamPCP is currently monetizing through supply chain credential theft rather than affiliate ransomware. Institutional response: NHS moved, CISA did not Takeaway: a meaningful first government alert, against continued and now increasingly anomalous US federal silence. NHS England Digital issued cyber alert cc-4781 on 2026-05-12, the first government advisory of the campaign to name the affected packages. Against that, the meaningful negatives still hold: CISA did not issue a standalone TeamPCP advisory, did not add CVE-2026-45321 to the Known Exploited Vulnerabilities catalog within the window, and has not named the operator. No Mandiant or Google Threat Intelligence Group named-actor product on the TanStack wave was published; technical attribution to TeamPCP rests on StepSecurity, Wiz, and Snyk. OpenAI published a corporate response titled "Our response to the TanStack npm supply chain attack". How the TanStack compromise worked (short version) The attacker did not steal npm credentials. They abused CI: a pull_request_target workflow ran fork-controlled code on a privileged GitHub Actions runner, GitHub Actions cache poisoning was staged through a renamed attacker fork, and the pipeline's OIDC token was extracted from runner process memory. The malicious package versions were then published by TanStack's own trusted release identity, which is why the provenance attestations are valid. Two staged attacker forks were used and should not be conflated: github[.]com/voicproducoes/router (created 2026-05-10, per StepSecurity) and github[.]com/zblgg/configuration (account zblgg, commits 2026-05-11 19:20 to 19:26 UTC, per Wiz and Snyk). What defenders should do now Inventory installs of @tanstack/* and the named packages (mistralai, guardrails-ai, @opensearch-project/opensearch, @uipath/, @squawk/mcp, @tallyui/) created during the compromise windows below; treat matching installs as suspect. Rotate npm, GitHub, cloud provider, and CI/CD tokens that were exposed to affected CI runners. Stop treating SLSA provenance or attestation as sufficient; pin exact versions and verify lockfile hashes against a known-good baseline. Block and alert on the indicators below at egress, including the C2 IP and domain and the Session messenger exfiltration nodes. Inspect developer endpoints for persistence in .vscode/tasks.json and~/.claude/settings.json . Audit GitHub Actions for pull_request_target running on forks and for cache-poisoning exposure. For the Checkmarx Jenkins AST plugin, confirm you are on a remediated build (2.0.13-848.v76e89de8a_053 or 2.0.13-847.v08c0072b_2fd5) and not the tampered 2026.5.09. Compromise time windows (for CI self-check) Checkmarx Jenkins AST plugin tampered version exposure: 2026-05-09 01:25 UTC to 2026-05-10 08:47 UTC. TanStack malicious npm publishes: 2026-05-11 19:20 UTC to 19:26 UTC; broader worm propagation across npm and PyPI continued through 2026-05-13. Indicators of compromise Watch items CISA action: a Known Exploited Vulnerabilities addition for CVE-2026-45321, a standalone TeamPCP advisory, or an emergency directive. The continued federal silence on a campaign of this profile is itself the watch item. Attribution: a Mandiant or Google Threat Intelligence Group named-actor product on the TanStack wave (the operator is tracked as UNC6780); current technical attribution rests only on StepSecurity, Wiz, and Snyk. Maintainer disclosures: postmortems or breach notifications from TanStack, Mistral AI, or Guardrails AI, including any SEC or privacy-law filings. A formal Checkmarx postmortem naming TeamPCP, given this is the third Checkmarx compromise in three months. Any verified wipe event, or a CERT-IL or CERT-IR advisory, tied to the locale-targeted destructive payload. Any patched Vect 2.1 release fixing the disclosed Vect 2.0 cryptographic flaw, or a CipherForce return after the prolonged freeze.

Ivanti, Fortinet, n8n, SAP, and VMware have released security fixes for various vulnerabilities that could be exploited by bad actors to bypass authentication and execute arbitrary code. Topping the list is a critical flaw impacting Ivanti Xtraction (CVE-2026-8043, CVSS score: 9.6) that could be exploited to achieve information disclosure or client-side attacks. "External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks," Ivanti said in an advisory. Fortinet published advisories for two critical shortcomings affecting FortiAuthenticator and FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS that could result in code execution - CVE-2026-44277 (CVSS score: 9.1) - An improper access control vulnerability in FortiAuthenticator that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests. (Fixed in FortiAuthenticator versions 6.5.7, 6.6.9, and 8.0.3) CVE-2026-26083 (CVSS score: 9.1) - A missing authorization vulnerability in FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS WEB UI that may allow an unauthenticated attacker to execute unauthorized code or commands via HTTP requests. (Fixed in FortiSandbox versions 4.4.9 and 5.0.2, FortiSandbox Cloud version 5.0.6, and FortiSandbox PaaS versions 4.4.9. and 5.0.2) SAP also shipped fixes for two critical vulnerabilities - CVE-2026-34260 (CVSS score: 9.6) - An SQL injection vulnerability in SAP S/4HANA CVE-2026-34263 (CVSS score: 9.6) - A missing authentication check in the SAP Commerce cloud configuration "The vulnerability is caused by an overly permissive security configuration with improper rule ordering, allowing an unauthenticated user to perform malicious configuration upload and code injection, resulting in arbitrary server-side code execution," Onapsis said about CVE-2026-34263. On the other hand, CVE-2026-34260 could be exploited by an attacker to inject malicious SQL statements and potentially impact the confidentiality and availability of the application. However, since the affected code only allows read access to data, the vulnerability does not compromise the integrity of the application. "It allows a low-privileged, authenticated attacker to inject malicious SQL code via user-controlled input, potentially exposing sensitive database information and crashing the application," Pathlock said. Patches have also been released by Broadcom for a high-severity flaw in VMware Fusion (CVE-2026-41702, CVSS score: 7.8) that could pave the way for local privilege escalation. The issue has been addressed in version 26H1. "VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary," Broadcom said. "A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed." Round off the list is a set of five critical vulnerabilities impacting n8n - CVE-2026-42231 (CVSS score: 9.4) - A vulnerability in the xml2js library used to parse XML request bodies in n8n's webhook handler that allows prototype pollution via a crafted XML payload, enabling an authenticated user with permission to create or modify workflows to achieve remote code execution on the n8n host. (Fixed in n8n versions 1.123.32, 2.17.4, and 2.18.1) CVE-2026-42232 (CVSS score: 9.4) - An authenticated user with permission to create or modify workflows could achieve global prototype pollution via the XML Node, leading to remote code execution when combined with other nodes exploiting the prototype pollution. (Fixed in n8n versions 1.123.32, 2.17.4, and 2.18.1) CVE-2026-44791 (CVSS score: 9.4) - A bypass for CVE-2026-42232 that could result in remote code execution on the n8n host. (Fixed in n8n versions 1.123.43, 2.20.7, and 2.22.1) CVE-2026-44789 (CVSS score: 9.4) - An authenticated user with permission to create or modify workflows could achieve global prototype pollution via an unvalidated pagination parameter in the HTTP Request node, leading to remote code execution on the n8n host. (Fixed in n8n versions 1.123.43, 2.20.7, and 2.22.1) CVE-2026-44790 (CVSS score: 9.4) - An authenticated user with permission to create or modify workflows could inject CLI flags on the Git node's Push operation, enabling an attacker to read arbitrary files from the n8n server and resulting in full compromise. (Fixed in n8n versions 1.123.43, 2.20.7, and 2.22.1) Software Patches from Other Vendors Security updates have also been released by other vendors over the past several weeks to rectify various vulnerabilities, including - ABB Adobe Amazon Web Services AMD Apple ASUS Atlassian Axis Communications AVEVA Canon Cisco CODESYS ConnectWise Dell Devolutions Drupal F5 Fortra Foxit Software Fujitsu GitLab GnuTLS Google Android and Pixel Google Chrome Google Cloud Grafana Hikvision Hitachi Energy Honeywell HP HP Enterprise (including Aruba Networking and Juniper Networks) Huawei IBM Intel Jenkins Lenovo Linux distributions AlmaLinux, Alpine Linux, Amazon Linux, Arch Linux, Debian, Gentoo, Oracle Linux, Mageia, Red Hat, Rocky Linux, SUSE, and Ubuntu MediaTek Meta WhatsApp Microsoft Mitel Mitsubishi Electric MongoDB Moxa Mozilla Firefox, Firefox ESR, and Thunderbird NVIDIA OPPO Palo Alto Networks Phoenix Contact Phoenix Technologies Progress Software QNAP Qualcomm React Ricoh Samsung Schneider Electric Siemens Sophos Spring Framework Supermicro Synology Tenable TP-Link WatchGuard Zoom, and Zyxel

Rilevata vulnerabilità in MongoDB Alert AL04/260519/CSIRT-ITA Sintesi Rilevata vulnerabilità con gravità “alta” in MongoDB Server. Tale vulnerabilità è legata alla gestione impropria degli indici “2dsphere_bucket” e “queryable_encrypted_range” e, qualora sfruttata, potrebbe consentire ad un utente malintenzionato di compromettere la disponibilità del servizio sui sistemi interessati. Tipologia Denial of Service Prodotti e/o versioni affette MongoDB Server 8.2.x, versioni precedenti la 8.2.6 8.0.x, versioni precedenti la 8.0.21 7.0.x, versioni precedenti la 7.0.32 Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni del bollettino di sicurezza riportato nella sezione Riferimenti.

Security researchers have discovered an unusual new threat campaign designed to target victims of notorious cybercrime group TeamPCP. PCPJack is a credential theft framework that “worms across exposed cloud infrastructure and removes artifacts associated with TeamPCP,” according to SentinelOne senior threat researcher, Alex Delamotte. TeamPCP is the group behind some major open source supply chain attacks this year, including one that compromised the GitHub Actions for Aqua Security's popular Trivy vulnerability scanner to deliver infostealer malware to countless downstream users including LiteLLM. “Many of the services targeted by the PCPJack framework are similar to the early TeamPCP/PCPCat campaigns from December 2025, before the high-visibility campaigns of early 2026 brought significant attention to TeamPCP and purportedly led to changes in group membership,” explained Delamotte In aSentinelLABS post. “We believe this could be a former operator who is deeply familiar with the group’s tooling.” After removing all artifacts associated with TeamPCP, PCPJack deploys code designed to replicate through the victim’s cloud systems – stealing credentials from Docker, Kubernetes, Redis, MongoDB, RayML, and vulnerable web applications, the SentinelLABS report noted. Although it’s programmed to steal cryptocurrency credentials, it lacks crypto-mining functionality. “Nearly all moderately-sophisticated cloud threat campaigns deploy XMRig or similar at some point, including several of TeamPCP’s campaigns,” Delamotte wrote. “This campaign does not, and it deliberately removes the miner functions associated with TeamPCP.” This suggests the goal is monetization through “credential theft, fraud, spam, extortion, or resale of stolen access,” she added. Mitigating PCPJack-Style Attacks SentinelOne urged organizations to defend against similar threats by sticking to cloud and web application security best practices, namely: Using a credential vault or secrets management service enterprise wide Ensuring access to credential vaults is never stored in a file saved in clear text Requiring multi-factor authentication (MFA) for service accounts, rather than an API key alone In AWS environments, ensuring that IMDSV2 is enforced across all services to prevent credential theft Allow-listing downloads only from approved S3 resources Using authentication for Docker and Kubernetes, even if not exposed to the internet (as they are popular targets for lateral movement) Applying principle of least privilege to Kubernetes service accounts “The impacts of PCPJack and similar toolsets range from data exposure and extortion to financial impacts of an attacker with access to high-limit, enterprise API services,” Delamotte warned.

A threat actor has launched a campaign to clean up environments infected by the infamous TeamPCP hacking group and deploy its own malicious tools, SentinelOne reports. Active since late April, the campaign relies on a malware framework targeting credentials across multiple cloud environments and capable of propagating itself. SentinelOne has named the framework PCPJack, due to its focus on removing from the infected systems any tools and artifacts associated with TeamPCP, the hacking group behind a recent flurry of supply chain attacks targeting multiple open source software ecosystems. “Many of the services targeted by the PCPJack framework are similar to the early TeamPCP/PCPCat campaigns from December 2025, before the high-visibility campaigns of early 2026 brought significant attention to TeamPCP and purportedly led to changes in group membership. We believe this could be a former operator who is deeply familiar with the group’s tooling,” SentinelOne says. A PCPJack infection, the cybersecurity company says, begins with a Linux shell script that sets up the environment and fetches additional payloads. Before that, it searches the system for processes and artifacts matching known TeamPCP infections and removes them. Next, the script creates a Python virtual environment, downloads six modules from an AWS S3 bucket, renames them, establishes persistence, launches the first module, which serves as the main framework orchestrator, and then deletes itself. The remaining modules, which are imported by the orchestrator, were designed for specific purposes, including credential parsing, lateral movement, command-and-control (C&C) message encryption, cloud IP range lookups, and cloud scanning. From the local system, PCPJack can steal .env and configuration files, environment variables, SSH keys, cryptocurrency wallets, credentials, and tokens for various web apps and cloud services, including AWS, Kubernetes, Docker, Gmail, GitHub, Office 365/Outlook, RayML, Slack, and WordPress. “The types of credentials collected by the framework suggest PCPJack’s targeting motivations are primarily to conduct spam campaigns and financial fraud, or to simply monetize stolen credentials to actors with these focuses. The inclusion of enterprise productivity software like Slack and business database services expands the focus to extortion attacks,” SentinelOne says. PCPJack performs system reconnaissance to identify assets the machine connects to, attempts lateral movement, and downloads Parquet files from Common Crawl to identify additional targets over the internet and attempt to infect them. The spreading module targets known vulnerabilities in web applications, including CVE-2025-29927 (Next.js), CVE-2025-55182 (React2Shell), CVE-2026-1357 (WPVivid Backup plugin for WordPress), CVE-2025-9501 (W3 Total Cache plugin for WordPress), and CVE-2025-48703 (CentOS Web Panel). PCPJack also attempts to use the extracted credentials to propagate across Kubernetes, Docker, Redis, RayML, and MongoDB deployments, and leverages SSH keys to execute the initial script on remote machines. The framework uses Telegram for C&C and encrypts the data sent to its channel. During its investigation into the framework, SentinelOne identified a second toolset associated with the threat actor, which includes Sliver implants and credential theft across dozens of cloud services, including Anthropic, Digital Ocean, Discord, Google API, and others, as well as those targeted by PCPJack. “Overall, the two toolsets are well developed and indicate that the owner values making code as a modular framework, despite some redundancies in behavior. The occasional operational security lapses were interesting, particularly their choice to encrypt everything except for Telegram credentials and their own alleged infrastructure,” SentinelOne notes. Related: Vendor Says Daemon Tools Supply Chain Attack Contained Related: AI Coding Agents Could Fuel Next Supply Chain Crisis Related: 1,800 Hit in Mini Shai-Hulud Attack on SAP, Lightning, Intercom Related: Sophisticated Quasar Linux RAT Targets Software Developers

A new malware framework called PCPJack is stealing credentials from exposed cloud infrastructure while actively removing TeamPCP's access to the systems. Among the targeted services are Docker, Kubernetes, Redis, MongoDB, RayML, and vulnerable web applications. In many cases, the threat actor moves laterally on the network. SentinelLabs researchers say that PCPJack appears designed for large-scale credential theft, and likely monetizes its activity via financial fraud, spam operations, credential resale, or extortion. TeamPCP is a cloud-focused threat group known for high-profile supply-chain breaches against Aqua Security’s Trivy scanner, the LiteLMM and Telnyx PyPI packages, and more recently, SAP npm packages. Because of the similarities with TeamPCP attacks, SentinelLabs believes that PCPJack may have been developed by a former TeamPCP affiliate or member that started their own operation. “Many of the services targeted by the PCPJack framework are similar to the early TeamPCP/PCPCat campaigns from December 2025, before the high-visibility campaigns of early 2026 brought significant attention to TeamPCP and purportedly led to changes in group membership,” explain the researchers. “We believe this could be a former operator who is deeply familiar with the group’s tooling.” In a report today, SentinelLabs says that PCPJack infects Linux-based cloud systems using a shell script called bootstrap.sh. Upon execution, it creates a hidden working directory, installs Python dependencies, downloads additional modules, establishes persistence, and launches the main orchestrator (monitor.py). During this initial stage, PCPJack explicitly checks for TeamPCP tooling and attempts to delete everything, thus claiming the compromise for themselves. The researchers say that the cleaning activity includes removing TeamPCP processes, services, containers, files, and persistence artifacts, completely eliminating the infections. PCPJack’s capabilities revolve mainly around credential theft, targeting cloud environments, developer systems, messenger apps, financial services, databases, SSH keys, Slack tokens, WordPress configs, OpenAI keys, Anthropic keys, Discord, DigitalOcean, and more. The credentials are exfiltrated to Telegram channels after they are encrypted using X25519 ECDH and ChaCha20-Poly1305, and split into 2800-byte chunks respecting Telegram’s message character limits. PCPJack propagates by scanning external cloud infrastructure for exposed services such as Docker, Kubernetes, Redis, MongoDB, and RayML, then attempts exploiting known vulnerabilities to gain access. It also downloads hostname data from Common Crawl parquet files and uses them as new targets for the scanning processscanning targets. SentinelLabs researchers note that PCPJack is exploiting the following vulnerabilities: CVE-2025-29927: auth bypass in Next.js middleware via crafted header CVE-2025-55182 (“React2Shell”): Server Actions deserialization flaw in React and Next.js CVE-2026-1357: unauthenticated file upload in WPVivid Backup CVE-2025-9501: PHP injection in W3 Total Cache via cached mfunc comment CVE-2025-48703: shell injection in CentOS Web Panel Filemanager changePerm functionality Inside compromised environments, the malware performs lateral movement by harvesting SSH keys and credentials, enumerating Kubernetes clusters and Docker daemons, and executing itself on reachable internal hosts. Once access is obtained, it establishes persistence using systemd services, cron jobs, Redis cron rewrites, or privileged containers before continuing propagation. SentinelLabs also found a Sliver-based backdoor on the threat actor’s infrastructure, with variants to support x86_64, x86, and ARM system architectures. To mitigate this risk, the researchers recommend enforcing multi-factor authentication (MFA), using IMDSv2 in AWS, ensuring proper authentication for Docker and Kubernetes services, following least-privilege principles, and avoiding storing secrets in plaintext. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Cybersecurity researchers have disclosed details of a new credential theft framework dubbed PCPJack that targets exposed cloud infrastructure and ousts any artifacts linked to TeamPCP from the environments. "The toolset harvests credentials from cloud, container, developer, productivity, and financial services, then exfiltrates the data through attacker-controlled infrastructure while attempting to spread to additional hosts," SentinelOne security researcher Alex Delamotte said in a report published today. PCPJack is specifically designed to target cloud services like Docker, Kubernetes, Redis, MongoDB, RayML, and vulnerable web applications, allowing the operators to spread in a worm-like fashion, aswell as move laterally within the compromised networks. It's assessed that the end goal of the cloud attack campaign is to generate illicit revenue for the threat actors through credential theft, fraud, spam, extortion, or resale of stolen access. The What makes this activity notable is that it shares significant targeting overlaps with TeamPCP, a threat actor that rose to prominence late last year by exploiting known security vulnerabilities (e.g., React2Shell) and misconfigurations in cloud services to enlist the endpoints in an ever-expanding network for conducting data theft and other post-exploitation actions. At the same time, PCPJack lacks a cryptocurrency mining component, unlike TeamPCP. While it's not known why this obvious monetization strategy was not adopted, the similarities between the two clusters indicate that PCPJack could be the work of a former member of TeamPCP who is familiar with the group's tradecraft. The starting point of the attack is a bootstrap shell script that's used to prepare the environment – such as configuring the payload host – and download next-stage tooling, while simultaneously taking steps to infect its own infrastructure, terminate and remove processes or artifacts that are associated with TeamPCP, install Python, establish persistence, download six Python scripts, launch the orchestration script, and remove itself. The six Python payloads are as follows - worm.py (written to disk as monitor.py), the main orchestrator that launches the purpose-built modules, conducts local credential theft, propagates the toolset to other hosts by exploiting known flaws (CVE-2025-55182, CVE-2025-29927, CVE-2026-1357, CVE-2025-9501, and CVE-2025-48703), and uses Telegram for command-and-control (C2) parser.py (utils.py), to handle credential extraction to categorize stolen keys and secrets lateral.py (_lat.py), to facilitate reconnaissance, harvest secrets, and enable lateral movement across SSH, Kubernetes, Docker, Redis, RayML, and MongoDB services crypto_util.py (_cu.py), to encrypt credentials before exfiltration to the attacker's Telegram channel cloud_ranges.py (_cr.py), to collect IP address ranges assigned to Amazon Web Services (AWS), Google Cloud, Microsoft Azure, Cloudflare, Cloudfront, and Fastly, and refresh the data every 24 hours cloud_scan.py (_csc.py), to run cloud port scanning for external propagation via Docker, Kubernetes, MongoDB, RayML, or Redis services Propagation targets for the orchestrator script come from parquet files that the worm pulls directly from Common Crawl, a non-profit that crawls the web and provides its archives and datasets to the public at no extra cost. "When exfiltrating system information and credentials, the PCPJack operator even collects success metrics on whether TeamPCP has been evicted from targeted environments in a 'PCP replaced' field sent to the C2," Delamotte said. This "implies a direct focus on the threat actor's activities rather than pure cloud attack opportunism." Further analysis of the threat actor's infrastructure has uncovered another shell script ("check.sh") that detects the CPU architecture and fetches the appropriate Sliver binary. It also scans Instance Metadata Service (IMDS) endpoints, Kubernetes service accounts, and Docker instances for credentials associated with Anthropic, Digital Ocean, Discord, Google API, Grafana Cloud, HashiCorp Vault, OnePassword, and OpenAI, and transmits them to an external server. "Overall, the two toolsets are well developed and indicate that the owner values making code as a modular framework, despite some redundancies in behavior," SentinelOne said. "This campaign does not [deploy miners], and it deliberately removes the miner functions associated with TeamPCP. Despite that, this actor has well-defined scopes for extracting cryptocurrency credentials."

Rilevate vulnerabilità in MongoDB Alert AL06/260507/CSIRT-ITA Sintesi Rilevate due vulnerabilità con gravità “alta” in MongoDB Server, noto database NoSQL open source. Tali vulnerabilità, qualora sfruttate, potrebbero consentire ad un utente malintenzionato di compromettere la disponibilità del servizio sui sistemi interessati Tipologia Denial of Service Prodotti e/o versioni affette MongoDB Server 8.2, versioni precedenti alla 8.2.7 Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni del bollettino di sicurezza riportato nella sezione Riferimenti.