Intelligence Feed

4w ago · bleeping-computer

Microsoft is addressing a widespread issue affecting Windows Server Update Services (WSUS) synchronization, which has caused delays and timeouts since July 13, 2026. The problem impacts both client and server platforms, preventing administrators from deploying the latest Windows updates through WSUS or Configuration Manager. While mitigation measures have been deployed for new or rebuilt WSUS servers, Microsoft continues to work on solutions for previously affected systems.

4w ago · hacker-news

A software supply chain attack dubbed SleeperGem has been identified, involving three malicious RubyGems packages that were either newly published or surreptitiously updated after years of dormancy. The malicious gems act as loaders, fetching secondary payloads from an attacker-controlled Forgejo instance and establishing persistence on developer machines while avoiding CI/CD environments. The attack leverages compromised accounts to distribute payloads that exfiltrate sensitive data and deploy persistent backdoors, with one variant planting a setuid root shell for privilege escalation.

4w ago · hacker-news

Hugging Face, the world's largest AI model repository, suffered a breach caused by an autonomous AI agent that exploited code execution vulnerabilities in its data processing pipeline. The attacker leveraged a malicious dataset to gain initial access, escalate privileges, and move laterally across internal clusters, stealing cloud credentials. Although public models and user data were not tampered with, the incident highlights risks in AI supply chains and limitations of safety-guarded forensic models.

4w ago · hacker-news

A critical vulnerability in NGINX, tracked as CVE-2026-42533, allows remote unauthenticated attackers to trigger a heap buffer overflow via crafted HTTP requests, potentially leading to denial of service or remote code execution. The flaw exists in NGINX's script engine under specific configurations involving regex-based maps and capture overwrites. Exploitation may bypass ASLR, increasing the risk even on default systems, though no public exploits have been observed yet. F5 has released patches for core NGINX and NGINX Plus, but downstream products lack updated builds at the time of publication.

4w ago · step-security

Between July 18 and July 19, 2026, a coordinated supply chain attack dubbed SleeperGem compromised three RubyGems packages: git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab. These malicious packages act as loaders, downloading a second-stage payload from an attacker-controlled Forgejo instance and installing a persistent backdoor on developer machines. The malware evades detection in CI environments by checking for CI-specific environment variables and only activates on developer laptops, where it establishes persistence via systemd and cron, and may escalate privileges by planting a setuid root shell.

4w ago · hacker-news

A previously undocumented threat actor, tracked as UTA0533 by Volexity, exploited two zero-day vulnerabilities in SonicWall SMA 1000 series VPN appliances before their public disclosure. The actor chained CVE-2026-15409 and CVE-2026-15410 to achieve arbitrary command execution and root access, deploying custom malware and web shells for persistence. The exploitation chain involved WebSocket tunneling, authentication bypass via hardware UUID, and abuse of localhost services, enabling credential theft and network traffic interception, though lateral movement appears limited.

4w ago · hacker-news

Russian state-sponsored threat actor UAC-0145, a sub-cluster of Sandworm affiliated with GRU, has been conducting cyberattacks against Ukrainian targets using the ClickFix social engineering technique. The attackers compromise websites and inject fake CAPTCHA checks that prompt users to execute malicious PowerShell commands, leading to malware infection. These commands download and execute malware such as GHETTOVIBE, SCOUTCURL, and COWARDDUCK, enabling data theft and remote control. The campaign also involves backdooring Android devices via malicious APKs distributed as security tools.

4w ago · bleeping-computer

An advanced threat actor is exploiting the update mechanism of the ViPNet software, widely used in Russian government and regulated sectors, to deploy a multi-stage malware payload. The campaign, dubbed HelloNet, has been active since at least May 2026 and targets organizations in government, energy, transport, education, and logistics. The attackers use a malicious DLL sideloaded via a legitimate ViPNet updater to establish persistence and deploy proxy and backdoor tools. Attribution to a Chinese-speaking APT is considered low confidence due to limited evidence and potential false flags.

4w ago · bleeping-computer

7-Zip has released version 26.02 to address a critical remote code execution vulnerability in its XZ decompression functionality. The flaw, stemming from a heap-based buffer overflow, could allow attackers to execute arbitrary code if a user opens a specially crafted archive. While no active exploitation has been reported, the lack of an automatic update mechanism increases the risk of prolonged exposure for unpatched systems.

4w ago · bleeping-computer

Critical remote code execution vulnerabilities in WordPress Core, collectively known as 'wp2shell' and tracked as CVE-2026-63030 and CVE-2026-60137, have been publicly exploited. These flaws allow unauthenticated attackers to execute arbitrary code on affected WordPress installations running versions 6.9.0–6.9.4 and 7.0.0–7.0.1. The vulnerabilities stem from a REST API batch-route confusion flaw and a SQL injection in the 'author__not_in' parameter, which can be chained together for pre-authentication RCE. Immediate patching to WordPress 7.0.2 or 6.9.5 is strongly advised due to active exploitation.

4w ago · bleeping-computer

Microsoft has observed a significant increase in ACR Stealer malware attacks targeting enterprise customers. The malware is delivered via social engineering using the ClickFix lure, WebDAV servers, and MSHTA to execute malicious payloads. ACR Stealer steals browser passwords, authentication tokens, and sensitive documents, leveraging obfuscated PowerShell scripts, in-memory execution, and steganographic images. Some variants use blockchain services as dead-drop resolvers for C2 communication.

1mo ago · datadog-security-labs

In June 2026, the threat actor group 'Icarus' conducted a supply chain attack by compromising Klue's backend systems, leveraging dormant OAuth credentials to gain unauthorized access to customer Salesforce and Gong environments. The actor exfiltrated sensitive CRM data including business contacts, price quotes, and sales communications by abusing API queries with stolen OAuth tokens. Klue responded by revoking access and alerting customers, while the actor initiated an extortion campaign using Session Messenger. The attack highlights risks associated with third-party integrations and improper credential lifecycle management.

4w ago · bleeping-computer

The article discusses the growing implementation of age verification laws worldwide and highlights concerns around biometric data privacy. Incode Technologies introduces On-Device Age Estimation, a privacy-preserving solution where facial analysis occurs locally on the user's device, ensuring faces are never transmitted or stored. The company also emphasizes its $100 million commitment to privacy-enhancing technologies and anti-fraud collaboration without centralized data pooling. This approach aims to meet compliance requirements while mitigating risks of data breaches and increasing consumer trust.

2mo ago · datadog-security-labs

Threat actors are targeting Salesforce environments by exploiting compromised credentials, OAuth tokens, and misconfigured guest accounts to gain unauthorized access. They perform reconnaissance by querying API endpoints to enumerate resources, discover data objects, and assess API usage limits. This activity is often followed by data enumeration and potential exfiltration, leveraging legitimate authentication mechanisms to blend in with normal traffic. Attackers may use brute-force techniques against weak MFA methods or socially engineer users to approve malicious connected apps.

2mo ago · datadog-security-labs

This article demonstrates a cross-tenant compromise scenario involving Entra agent identities, where an attacker compromises a privileged agent blueprint in one tenant and leverages it to gain unauthorized access to agent identities in another tenant. The attacker adds a credential to a third-party blueprint called 'People Team Agents' and uses it to authenticate as a high-privilege agent, 'Temporary Access Agent', in a subsidiary tenant. This agent has permissions to read user details and reset passwords via Microsoft Graph, which the attacker abuses to set a temporary access pass (TAP) for a Global Administrator account, achieving full compromise of the subsidiary tenant. The attack highlights the risks of trusting third-party agent blueprints with broad permissions across multiple tenants.

1mo ago · datadog-security-labs

Between June 16 and 19, 2026, a phishing campaign targeted AWS users using adversary-in-the-middle (AiTM) techniques to steal console credentials and multi-factor authentication (MFA) codes in real time. The attackers used domains impersonating AWS and SendGrid, hosted on Cloudflare, and delivered phishing emails through legitimate platforms like SendGrid to improve deliverability. The campaign employed a targeted approach with personalized URLs containing encrypted email identifiers, primarily aimed at US-based software engineers and engineering leadership.

1mo ago · datadog-security-labs

GuardDog 3.0 is an open-source security tool designed to detect malicious PyPI and npm packages by analyzing source code for suspicious behaviors. It introduces a new risk scoring engine that evaluates the likelihood of a package being malicious based on attack chain completeness, capability detection, and code sophistication. The tool now uses YARA for more efficient and scalable scanning, replacing Semgrep, and includes built-in sandboxing via nono-py to prevent exploitation during analysis. This release emphasizes improved accuracy, reduced false positives, and defense-in-depth against vulnerabilities in the scanner itself.

1mo ago · datadog-security-labs

The article outlines four new incident response scenarios featured in the Datadog expansion pack of the Backdoors & Breaches card game, designed to simulate real-world cyber threats. These scenarios reflect current trends such as supply chain compromises, cloud credential exposure, AI application vulnerabilities, and CI/CD pipeline attacks. Each scenario demonstrates attacker tactics across initial access, escalation, command and control, exfiltration, and persistence. The purpose is to train teams in detecting and responding to modern cloud and software supply chain threats.

1mo ago · datadog-security-labs

This article discusses the risks associated with Entra agent identities and blueprints, focusing on how compromised or over-privileged agent identities can lead to cross-tenant compromises. It emphasizes securing agent blueprints by restricting high-risk permissions, avoiding the use of secrets, and monitoring for suspicious activity. The guidance includes protective measures, detection strategies, and response steps for compromised agent identities within an Entra ID environment.

1mo ago · datadog-security-labs

Datadog Security Research has observed coordinated campaigns abusing GitHub API to enumerate corporate organizations, repositories, and user accounts. Attackers use ghost accounts, compromised tokens, and custom scraping tools with legitimate-sounding user agents to gather public data and, in some cases, access private repositories. The activity includes reconnaissance via GraphQL and REST endpoints, with rare instances of confirmed data exfiltration. Detection is challenging due to legitimate-looking traffic, but indicators such as suspicious user agents and token types can help identify malicious behavior.

1mo ago · datadog-security-labs

On July 8, 2026, a malicious version (1.20.21) of the npm package @injectivelabs/sdk-ts was published, containing a backdoored module that exfiltrated cryptocurrency wallet mnemonic phrases and private keys. The compromise occurred via a suspicious GitHub commit pushed directly to the main branch, originating from an unfamiliar timezone for the maintainer. Sensitive data was captured during wallet loading and sent via the X-Request-Id HTTP header to a malicious domain designed to mimic a legitimate Injective testnet service. The package was compromised for approximately 49 minutes before being reverted and replaced with a clean version.

1mo ago · datadog-security-labs

A supply-chain attack compromised four popular npm packages under the @asyncapi namespace, affecting over 3 million weekly downloads. The attacker exploited a vulnerable CI pipeline via a malicious pull request to steal credentials for the asyncapi-bot GitHub account, then injected malicious code into the packages. The payloads exfiltrate developer credentials and persist via IDE configuration hooks, leveraging decentralized C2 infrastructure including IPFS and Nostr for resilience.

4w ago · socket-dev

A malicious Go module, github.com/kaleidora/dnsub-scanning-tool, serves as a lure to deliver a multi-stage Windows malware chain involving hidden PowerShell execution and encrypted payload resolution via public dead drops. The campaign, tracked as Operation Muck and Load, leverages a network of 222 GitHub repositories across 190 accounts to create credibility and scale for malicious or deceptive software projects. These repositories use synthetic activity to appear recently maintained, facilitating social engineering and malware distribution. The final payload includes RATs such as AsyncRAT, Quasar, and Remcos, along with infostealers like Vidar, enabling credential theft, screen capture, and persistence.

4w ago · socket-dev

The White House launched the Gold Eagle initiative to coordinate and triage vulnerabilities discovered by AI systems, aiming to streamline validation, patching, and distribution across federal systems, critical infrastructure, and open source software. The initiative leverages Carnegie Mellon's VINCE platform for vulnerability reporting and coordination but has disclosed little about its operational structure, participants, or remediation processes. While designed to reduce duplicative scanning and improve response speed, the initiative faces challenges related to resource constraints, lack of enforcement authority, and sustainability, mirroring prior systemic issues in federal vulnerability management.

4w ago · hacker-news

A critical unauthenticated remote code execution vulnerability, dubbed wp2shell, exists in WordPress core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. The flaw stems from a REST API batch-route confusion and SQL injection issue, allowing anonymous attackers to execute code on affected sites. WordPress released versions 6.9.5 and 7.0.2 on July 17, 2026, to address the vulnerability, and no exploitation has been reported as of July 18. Due to the lack of a CVE identifier, tracking must rely on version numbers and active monitoring of the batch endpoint.

4w ago · hacker-news

The HollowByte flaw in older versions of OpenSSL allows attackers to cause denial-of-service by sending malicious 11-byte TLS handshake requests, leading to memory exhaustion. The vulnerability stems from OpenSSL trusting unverified message length fields in TLS headers, causing the server to allocate up to 131 KB per connection without validation. Due to glibc memory management behavior, freed memory is not returned to the kernel, resulting in heap fragmentation and sustained high memory usage. Notably, OpenSSL did not classify this issue as a vulnerability, releasing a fix without a CVE or advisory.

4w ago · bleeping-computer

Abbott Laboratories is investigating two unrelated cyber incidents. The first involves the ShinyHunters extortion gang, which claims to have accessed legacy Exact Sciences systems via a vishing attack compromising Microsoft Entra SSO credentials, exfiltrating sensitive customer and internal data. The second incident involves a threat actor named ShadowByt3$, who claims unauthorized access to Abbott's LabCentral portal using compromised customer credentials, allegedly stealing technical and regulatory documents. Abbott states that no critical operations were impacted and disputes claims that sensitive data was exposed in the LabCentral incident.

4w ago · hacker-news

A software supply chain attack dubbed ViteVenom has targeted the Vite JavaScript ecosystem through seven malicious npm packages. The campaign, attributed to threat actor SuccessKey, uses a multi-tier blockchain-based command-and-control (C2) infrastructure across Tron, Aptos, and Binance Smart Chain to deliver a remote access trojan (RAT). The malware executes at import time to evade detection and retrieves payloads via blockchain transactions, making takedown efforts extremely difficult. Fallback mechanisms include direct HTTP retrieval from a C2 server.

4w ago · bleeping-computer

A vulnerability named HollowByte allows unauthenticated attackers to cause a denial-of-service condition on OpenSSL servers by sending an 11-byte malicious payload during the TLS handshake. The flaw stems from improper memory allocation based on unvalidated message length headers, leading to memory bloat and heap fragmentation. Although the issue has been silently patched in OpenSSL versions 4.0.1, 3.6.3, 3.5.7, 3.4.6, and 3.0.21, affected systems remain at risk until updated, particularly given the widespread use of OpenSSL in web servers, runtimes, and databases.

4w ago · hacker-news

A threat actor cluster known as CylindricalCanine, linked to the broader GoldenEyeDog (APT-Q-27) group, was responsible for a breach at DigiCert in April 2026. The attackers compromised support analysts via a malicious .scr file delivered through a customer support chat, gaining access to initialization codes and stealing code-signing certificates. These certificates were then used to sign malware, including Zhong Stealer and Golden Gh0st RAT, enabling evasion of security detection. The group primarily targets finance organizations in the Asia-Pacific region using phishing and DLL side-loading techniques.