Tag: access
-
Digital IDs and the AI threat: verification must evolve, not just digitise
By Marc de Beaucorps, Co-founder and CEO of Finovox The UK’s rollout of new digital IDs is being pitched as a straightforward upgrade involving safer age checks, smoother access, and fewer fakes. But from a fraud perspective, “simpler” can be a dangerous word. Identity fraud rarely disappears; it mutates. And when you digitize identity, you…
-
Atlassian Vulnerability Comes Under Attack Hours After Details Go Public
Threat actors are exploiting CVE-2026-21589, a critical Atlassian flaw that can expose sensitive files across multiple Data Center products. Threat actors have started exploiting CVE-2026-21589 (CVSS score of 9.3), a critical arbitrary file access flaw in Atlassian Data Center products. The vulnerability could allow attackers to access sensitive files under certain conditions. Affected products include…
-
ChainDrop and PolinRider Use Blockchain C2 to Steal Cloud and CI/CD Credentials
Tags: access, blockchain, cloud, control, credentials, cyber, endpoint, infrastructure, korea, network, north-korea, open-source, service, threat, wormThreat actors are increasingly using blockchain networks as resilient command-and-control infrastructure to steal cloud credentials from developer endpoints and CI/CD environments. Recent campaigns involving the ChainDrop npm worm and the North Korea-linked PolinRider operation show how poisoned open-source packages can harvest short-lived cloud tokens, service-account credentials, deployment secrets, and source-code access tokens while resolving attacker…
-
Critical Citrix NetScaler CVE-2026-88771 Exploited for Reverse Shells and Persistent Access
Attackers are exploiting CVE-2026-88771, a critical pre-authentication command-injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway, to deploy reverse shells, create privileged accounts, and establish persistent access. LevelBlue’s Threat Hunt Operations & Research (THOR) team identified malicious authentication events across multiple customer environments, documenting activity extending beyond vulnerability testing into payload execution and configuration theft…
-
Hackers Abuse GitHub Actions to Steal SSH Keys, Cloud Credentials and Access Tokens
Hackers are abusing GitHub Actions to steal SSH keys, cloud credentials, and access tokens through malicious workflows disguised as security checks. The workflows targeted 2,577 secrets, but targeting did not always translate into theft. Researchers confirmed successful exfiltration of 26 secrets from 13 repositories, highlighting the distinction between malicious injections and executed payloads. Attackers inserted…
-
Hackers Abuse GitHub Actions to Steal SSH Keys, Cloud Credentials and Access Tokens
Hackers are abusing GitHub Actions to steal SSH keys, cloud credentials, and access tokens through malicious workflows disguised as security checks. The workflows targeted 2,577 secrets, but targeting did not always translate into theft. Researchers confirmed successful exfiltration of 26 secrets from 13 repositories, highlighting the distinction between malicious injections and executed payloads. Attackers inserted…
-
Anthropic Expands Access to Frontier Cyber AI Models
3 Access Tiers Cover Defense, Red Teaming and Critical Systems. Anthropic opened its advanced cyber AI program to applications from any organization, offering tiered access for defense, red teaming and critical infrastructure testing as increasingly capable models become available to attackers and defenders alike. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/anthropic-expands-access-to-frontier-cyber-ai-models-a-33035
-
Anthropic Gives Vetted Defenders Fewer Claude Guardrails
Anthropic has merged Project Glasswing into a tiered access program for its advanced cyber LLMs, including Opus, Sonnet, and Mythos. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/anthropic-vetted-defenders-claude-guardrails
-
Insider Threat Risks Rise Amid Layoffs and Workforce Changes
Workforce changes can increase insider threat risks. Learn how access controls, credential security, DLP, and third-party oversight can reduce exposure. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/news/layoffs-lead-to-rise-in-insider-threat-risk/
-
SonicWall Fixes Max Severity Pre-Auth Flaw in SMA1000 Appliances
SonicWall patched a CVSS 10 pre-auth SSRF flaw in SMA1000 appliances that could let unauthenticated attackers reach internal functions. SonicWall released hotfixes for four vulnerabilities in its SMA1000 remote access appliances, including a critical flaw tracked as CVE-2026-102255 (CVSS score of 10.0. The issue is a pre-authentication SSRF bug in the WorkPlace portal that could…
-
Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer
Cybersecurity researchers have disclosed details of a long-running npm supply chain malware campaign that pushes information stealers and remote access trojans (RAT) to compromised hosts.The campaign has been codenamed MALFEX by CloudSEK and Checkmarx. The activity is assessed to be the work of a lone threat actor who appears to have published 12 packages since…
-
Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer
Cybersecurity researchers have disclosed details of a long-running npm supply chain malware campaign that pushes information stealers and remote access trojans (RAT) to compromised hosts.The campaign has been codenamed MALFEX by CloudSEK and Checkmarx. The activity is assessed to be the work of a lone threat actor who appears to have published 12 packages since…
-
SonicWall Patches CVSS 10.0 Pre-Authentication SSRF Flaw in SMA1000 Appliances
SonicWall has released hotfixes for four flaws in its SMA1000 appliances, the gateways that give remote workers access to a company’s network and applications. The most serious could allow an attacker without a login to send requests through the appliance and reach internal functions.SonicWall rates it 10.0 on the CVSS scale and says it has…
-
Anhörung zu Vorratsdatenspeicherung: Ermittler fordern Zugriff auf Inhaltsdaten bei Quick-Freeze
Tags: accessInternetprovider sollen künftig IP-Adressen drei Monate lang speichern. Kritiker sehen für die Speicherdauer keine Evidenz. First seen on golem.de Jump to article: www.golem.de/news/anhoerung-zu-vorratsdatenspeicherung-ermittler-fordern-zugriff-auf-inhaltsdaten-bei-quick-freeze-2610-213839.html
-
FBI warns that FortiBleed credential-harvesting attacks are locking out firewall users
An initial access broker is working with various ransomware groups in a global campaign. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/fbi-fortibleed-credential-harvesting-attacks/832366/
-
Goldenes Trump Phone: Hacker veröffentlichen Kundendaten von Trump Mobile
Die Hackinggruppe hat wohl noch immer Zugriff auf die Systeme von Trump Mobile. Die nutzten nicht einmal eine Zweifaktor-Authentifizierung. First seen on golem.de Jump to article: www.golem.de/news/goldenes-trump-phone-hacker-veroeffentlichen-kundendaten-von-trump-mobile-2610-213834.html
-
FBI warns that FortiBleed credential-harvesting attacks are locking out firewall users
An initial access broker is working with various ransomware groups in a global campaign. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/fbi-fortibleed-credential-harvesting-attacks/832366/
-
FBI warns that FortiBleed credential-harvesting attacks are locking out firewall users
An initial access broker is working with various ransomware groups in a global campaign. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/fbi-fortibleed-credential-harvesting-attacks/832366/
-
Atlassian Warns of Critical Flaw Affecting Eight Self-Managed Products
Atlassian has disclosed CVE-2026-21589, a critical arbitrary file access vulnerability affecting Confluence Data Center and seven other self-managed products. The advisory, published on October 5, 2026, warns that every version of the affected software is exposed and urges administrators to act right away, either by upgrading or by putting temporary safeguards in place. First seen…
-
Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589)
One day after Atlassian released patches fixing a critical arbitrary file access vulnerability (CVE-2026-21589) in its self-managed Data Center products, and a few hours after … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/07/exploitation-critical-atlassian-flaw-cve-2026-21589/
-
Power BI phishing campaign drops rogue ScreenConnect clients
Attackers are abusing Microsoft Power BI to host phishing lures that slip past email security, before dropping multiple rogue ScreenConnect clients on victims’ machines to secure persistent remote access, according to new research from Huntress. The campaign, first observed on 10 September, uses public Power BI dashboards on Microsoft’s legitimate app.powerbi.com domain as the landing…
-
Russian-Speaking CyberXero Uses AI Agent Swarm to Attack Ukrainian Energy Infrastructure
CyberXero, a Russian-speaking initial access broker combining conventional exploitation tools with AI agents to pursue global website compromises and targeted intrusions against Ukrainian energy infrastructure. The findings describe an active, financially motivated operation rather than a confirmed state-sponsored campaign. Its selective interest in Ukrainian utilities raises questions about potential access buyers, but researchers found no…
-
Russian-Speaking CyberXero Uses AI Agent Swarm to Attack Ukrainian Energy Infrastructure
CyberXero, a Russian-speaking initial access broker combining conventional exploitation tools with AI agents to pursue global website compromises and targeted intrusions against Ukrainian energy infrastructure. The findings describe an active, financially motivated operation rather than a confirmed state-sponsored campaign. Its selective interest in Ukrainian utilities raises questions about potential access buyers, but researchers found no…
-
Critical Progress DataDirect GenAI Flaw Lets Attackers Execute Arbitrary OS Commands
Progress has disclosed a critical command injection vulnerability in the Early Access Release of its DataDirect Autonomous REST Connector AI Model Generator agents. This vulnerability, tracked as CVE-2026-91140, allows specially crafted OpenAPI or Swagger documents to execute arbitrary operating system commands within the environment running an affected agent. The security bulletin, dated October 6, 2026,…
-
Critical Progress DataDirect GenAI Flaw Lets Attackers Execute Arbitrary OS Commands
Progress has disclosed a critical command injection vulnerability in the Early Access Release of its DataDirect Autonomous REST Connector AI Model Generator agents. This vulnerability, tracked as CVE-2026-91140, allows specially crafted OpenAPI or Swagger documents to execute arbitrary operating system commands within the environment running an affected agent. The security bulletin, dated October 6, 2026,…
-
Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details
Threat actors have begun to exploit a newly disclosed critical security flaw impacting Atlassian Data Center products that could allow access to sensitive files under certain conditions.The arbitrary file access flaw, tracked as CVE-2026-21589 (CVSS score: 9.3) affects multiple products, including Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software First…
-
Hackers hijack three country-code domain registries, obtain HTTPS certificates for Google domains
Attackers who took control of three country-code top-level domains (ccTLDs) used that access to obtain HTTPS certificates for several Google domains and for domains run by … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/07/google-unauthorized-https-certificates-cctld-hijacks/
-
Hackers hijack three country-code domain registries, obtain HTTPS certificates for Google domains
Attackers who took control of three country-code top-level domains (ccTLDs) used that access to obtain HTTPS certificates for several Google domains and for domains run by … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/07/google-unauthorized-https-certificates-cctld-hijacks/
-
SonicWall fixes pre-auth SSRF flaw in SMA 1000 appliances (CVE-2026-102255)
SonicWall has patched four vulnerabilities in its popular Secure Mobile Access (SMA) 1000 series of appliances, including one (CVE-2026-102255) that could allow remote … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/07/sonicwall-fixes-pre-auth-ssrf-flaw-in-sma-1000-appliances-cve-2026-102255/