Aggregator

A vulnerability was found in osquery up to 5.23.0. It has been rated as problematic. This affects the function getOriginalProgramName of the component Authenticode. Performing a manipulation results in out-of-bounds write. This vulnerability is reported as CVE-2026-54001. The attack requires a local approach. No exploit exists.

A vulnerability was found in osquery up to 5.23.0. It has been declared as very critical. The impacted element is an unknown function of the component Process Command-Line/Current Directory Parser. Such manipulation leads to out-of-bounds write. This vulnerability is documented as CVE-2026-54000. The attack needs to be performed locally. There is not any exploit available.

A vulnerability was found in Red Hat OpenShift AI. It has been classified as problematic. The affected element is an unknown function of the component File Type Content Detector. This manipulation causes server-side request forgery. This vulnerability is registered as CVE-2026-15143. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability was found in decolua 9router 0.3.75/0.4.1/0.4.44 and classified as very critical. Impacted is an unknown function of the file /api/settings/database of the component Settings Handler. The manipulation results in improper authentication. This vulnerability is cataloged as CVE-2026-55500. The attack may be launched remotely. There is no exploit available.

A vulnerability has been found in 1Panel-dev MaxKB up to 2.10.0 and classified as problematic. This issue affects some unknown processing of the file apps/application/chat_pipeline/step/chat_step/impl/base_chat_step.py of the component MCP Referencing Mode. The manipulation leads to deserialization. This vulnerability is listed as CVE-2026-54149. The attack may be initiated remotely. There is no available exploit.

A vulnerability, which was classified as problematic, was found in Grafana up to 11.6.14/12.2.8/12.3.6/12.4.3/13.0.1. This vulnerability affects unknown code of the component Grafana API Endpoint. Executing a manipulation can lead to uncontrolled memory allocation. This vulnerability is tracked as CVE-2026-33382. The attack can be launched remotely. No exploit exists.

2026 年 6 月底，NPM 平台出现 7 个拼写劫持恶意软件包，仿冒 Anthropic、OpenAI、LangChain、Ollama、Vercel 等主流 AI 开发工具及 Argon2 密码哈希库，累计下载量约 2 万次。安全研究团队溯源发现，这批恶意包均由以色列某隐身模式网安初创公司的创始人发布。 这批恶意包均利用 npm 安装脚本机制触发攻击：通过package.json中的postinstall/preinstall字段配置恶意代码，在npm install执行阶段静默运行，权限与执行用户一致，攻击全程发生在业务代码调用库文件之前。攻击者采用诱饵与载荷分离的设计：src目录下为正常可用的工具代码，仅作掩人耳目之用，真正的 16KB 恶意窃取脚本藏于scripts目录中，可绕过常规源码审计。 恶意脚本以 “匿名遥测” 为伪装，提供环境变量退出机制降低用户戒备，实则采集完整的开发者身份图谱：包括设备主机名、Git 提交邮箱、GitHub 账号、SSH 公钥备注、AWS/GCP 云配置信息、企业 DNS 后缀、所在私有仓库信息、CI 环境标识等 11 类数据。脚本刻意不直接窃取密钥凭证，仅采集身份与环境信息，规避明确违法红线，为后续定向钓鱼、社工攻击提供基础素材。 所有窃取数据均发往 Google Cloud Run 无服务器域名，该域名默认在多数企业出站白名单中，且流量全程加密，难以被常规安全设备检测。攻击者还采用版本回填手法，批量发布 20 个历史版本伪造项目成熟度，绕过基于包龄的信誉检测。 研究显示，该攻击者的手法存在清晰迭代轨迹：2026 年 4 月发布的早期仿冒包手法粗糙，仅采集主机名与 Git 邮箱；6 月的 AI 工具仿冒包完成全量功能升级，社会工程设计更完善，甚至通过 SEO 优化的故障排查文案诱导开发者安装。 与常规供应链攻击不同，本次攻击者使用真实身份Vigilance发布恶意包 图8。 研究团队排除了普通数据盗窃与合规安全研究两种可能，推测其核心动机为初创公司产品冷启动： 通过采集真实开发者环境数据搭建数据集，支撑供应链攻击检测、开发者画像类安全产品，一旦暴露便以 “安全研究” 作为托词。目前涉事账号与所有恶意包均已被 NPM 平台下架。 核心IOC指标包括两个 Cloud Run 外泄端点npm-package-logger-228835561205.europe-west1.run[.]app、npm-package-logger-228835561205.us-central1.run[.]app，以及anthropic-toolkit、ai-sdk-helpers等 7 个涉事恶意包。 相关报告链接： https://opensourcemalware.com/blog/cybersecurity-startup-publishes-infostealers-to-npm

A vulnerability, which was classified as problematic, has been found in JetBrains TeamCity up to 2026.1.1. This affects an unknown part of the component Agent Registration. Performing a manipulation results in cross site scripting. This vulnerability is identified as CVE-2026-59795. The attack can be initiated remotely. There is not any exploit available.

A former ransomware negotiator from Florida has been sentenced to federal prison for helping BlackCat/ALPHV ransomware actors extort U.S. victims while he was supposed to be helping victims respond to attacks.

A vulnerability classified as problematic was found in JetBrains TeamCity up to 2026.1.1. Affected by this issue is some unknown functionality of the component Cloud Profile Page. Such manipulation leads to cross site scripting. This vulnerability is referenced as CVE-2026-59794. It is possible to launch the attack remotely. No exploit is available.

A vulnerability classified as critical has been found in JetBrains TeamCity up to 2026.1.1. Affected by this vulnerability is an unknown functionality of the component Permission Check. This manipulation causes permission issues. The identification of this vulnerability is CVE-2026-59796. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability described as critical has been identified in JetBrains TeamCity up to 2026.1.1. Affected is an unknown function of the component Perforce VCS Integration. The manipulation results in improper access controls. This vulnerability was named CVE-2026-59793. The attack may be performed from remote. There is no available exploit.

A vulnerability marked as critical has been reported in MervinPraison PraisonAI up to 4.6.77. This impacts an unknown function of the file /api/v1/runs of the component Jobs API. The manipulation of the argument webhook_url leads to server-side request forgery. This vulnerability is uniquely identified as CVE-2026-60091. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability labeled as problematic has been found in MervinPraison PraisonAI up to 1.6.77. This affects the function agent.start of the file .praisonai/config.toml of the component Config File Handler. Executing a manipulation of the argument output_file can lead to path traversal. This vulnerability is handled as CVE-2026-60089. It is possible to launch the attack on the local host. There is not any exploit available.

A vulnerability identified as very critical has been detected in MervinPraison PraisonAI up to 4.6.77. The impacted element is an unknown function of the component Shell Command Execution. Performing a manipulation results in os command injection. This vulnerability is known as CVE-2026-61434. Remote exploitation of the attack is possible. No exploit is available.

A Bulgarian national has been charged with stealing $290,000 in government-seized cryptocurrency while serving 121 months in prison for helping launder millions stolen from American fraud victims. [...]

If you need one appliance that handles firewalling, intrusion prevention, VPN, antivirus, and web filtering without a security team to run it, Fortinet FortiGate is our top UTM pick for 2026, with Sophos Firewall the strongest choice when you also run Sophos endpoints. Unified threat management (UTM) consolidates multiple network security functions into a single […]

The post Top 10 Best Unified Threat Management (UTM) Solutions in 2026 appeared first on Cyber Security News.

A new multi-purpose backdoor allows cyber threat actors to conduct both quiet espionage activity and destructive wiping operations

A vulnerability categorized as problematic has been discovered in MervinPraison PraisonAI up to 1.6.77. The affected element is the function execute_tool of the file praisonaiagents.context.fast of the component FastContext Feature. Such manipulation of the argument tool leads to path traversal. This vulnerability is traded as CVE-2026-61432. The attack may be launched remotely. There is no exploit available.