CVE

CVE-2026-27771

View on NVD ↗

Gitea Composer package source links use insufficient permission checks

Exploitation IoCs 3

Domain corepack[.]org
Filename lib/.threadpool.rb
IP 165[.]154[.]236[.]93

MITRE ATT&CK TTPs 13

T1027
Obfuscated Files or Information
Defense Evasion
 T1056.001
Keylogging
Collection
 T1059.001
PowerShell
Execution
 T1071.001
Web Protocols
Command And Control
 T1082
System Information Discovery
Discovery
 T1083
File and Directory Discovery
Discovery
 T1098
Account Manipulation
Persistence
 T1105
Ingress Tool Transfer
Command And Control
 T1114
Email Collection
Collection
 T1555
Credentials from Password Stores
Credential Access
 T1566
Phishing
Initial Access
 T1570
Lateral Tool Transfer
Lateral Movement
 T1588
Obtain Capabilities
Resource Development

Source Articles

⚡ Weekly Recap: Rogue AI Models, $88M Bitcoin Theft, Water-System Attacks and Dangling DNS Hijacks
Multiple active threats were reported this week, including Russian threat actors exploiting a Microsoft OWA XSS vulnerability (CVE-2026-42897) to deploy a JavaScript-based implant called OWAReaper for persistent mailbox access. A critical Ruby on Rails vulnerability (CVE-2026-66066) allows unauthenticated attackers to read arbitrary files via crafted image uploads, potentially leading to remote code execution. Additionally, Iranian-linked actors are suspected in coordinated attacks on over 30 Minnesota water systems, where exposed PLCs were targeted to disrupt operations. Storm-2945 (APT29) conducted DNS hijacking via compromised Wi-Fi networks to deliver CornFlake malware and ChocoShell infostealer, while a malicious campaign in RubyGems distributed 199 trojanized packages embedding XMRig cryptojacking payloads.
hacker-news Aug 3, 2026