CVE

CVE-2026-110392

View on NVD ↗

Samsung QA-Board — Unauthenticated OS command injection via output redo/tuning

Exploitation IoCs 2

Domain easyllms[.]xyz
Filename payload.bin

MITRE ATT&CK TTPs 20

T1021
Remote Services
Lateral Movement
 T1027
Obfuscated Files or Information
Defense Evasion
 T1053.005
Scheduled Task
Execution
 T1055
Process Injection
Defense Evasion
 T1056.001
Keylogging
Collection
 T1059
Command and Scripting Interpreter
Execution
 T1059.001
PowerShell
Execution
 T1070.004
File Deletion
Defense Evasion
 T1071
Application Layer Protocol
Command And Control
 T1071.004
DNS
Command And Control
 T1074
Data Staged
Collection
 T1082
System Information Discovery
Discovery
 T1083
File and Directory Discovery
Discovery
 T1090
Proxy
Command And Control
 T1105
Ingress Tool Transfer
Command And Control
 T1133
External Remote Services
Persistence
 T1485
Data Destruction
Impact
 T1490
Inhibit System Recovery
Impact
 T1491
Defacement
Impact
 T1566
Phishing
Initial Access

Source Articles

ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More
Multiple active threats were reported, including ransomware groups Qilin and Settra exploiting a PAN-OS authentication bypass vulnerability (CVE-2026-0257). A cryptocurrency wallet drainer kit called Noir uses DNS TXT records hosted on Cloudflare Pages to locate backend infrastructure. A new Rust-based remote access trojan, CikaBika Bot, leverages Discord for C2 communications. The KGB RAT malware, advertised on cybercrime forums, combines data theft with psychological harassment features. Adobe Experience Manager cloud instances are vulnerable to an unauthenticated RCE chain. Samsung patched a critical unauthenticated RCE in its QA-Board tool, while NVIDIA's Linux GPU driver has a privilege escalation and container escape flaw.
hacker-news Oct 15, 2026