Home > Directory > Sicurezza > SecureBulletin
SecureBulletin EN
Cybersecurity news in English · visibilità: nel misto della home, non in primo piano.
Sito originale · Feed RSS della fonte
1.243 voci in archivio · mostrate 726–750 .
Malicious DeepSeek-Claw AI Skill Delivers Remcos RAT and GhostLoader in Agentic AI Supply Chain Attack
Zscaler ThreatLabZ has uncovered a campaign where attackers published a fake DeepSeek integration for the OpenClaw AI framework on GitHub, hiding malicious commands in a SKILL.md file. The attack deploys Remcos RAT on Windows and the GhostL…
Vercel Data Breach: ShinyHunters Exploit OAuth Supply Chain Attack to Steal Customer Credentials for $2M Sale
Vercel has confirmed a security breach originating through a compromised third-party AI tool (Context.ai), where attackers used stolen OAuth tokens to access internal systems and enumerate customer environment variables. The stolen data, in…
Critical Palo Alto PAN-OS Zero-Day CVE-2026-0300 Actively Exploited — Root Access Granted on 5,800+ Exposed Firewalls
A critical buffer overflow zero-day in Palo Alto Networks PAN-OS (CVE-2026-0300, CVSS 9.3) is being actively exploited in the wild. Unauthenticated attackers can gain full root access to PA-Series and VM-Series firewalls. Over 5,800 devices…
DigiCert Breached via Weaponized Screensaver: Threat Actor Steals EV Code Signing Certificates to Spread Zhong Stealer
A sophisticated threat actor breached DigiCert’s internal support environment in early April 2026 by tricking analysts into executing a disguised .scr malware file, ultimately obtaining EV Code Signing certificates used to distribute the Zh…
Microsoft Edge Stores Your Entire Password Vault in Cleartext Process Memory — Every Session
Security researcher @L1v1ng0ffTh3L4N has revealed that Microsoft Edge decrypts all stored passwords into plaintext process memory at browser launch and keeps them there for the entire session. Unlike Chrome, Edge lacks on-demand decryption…
Critical Apache HTTP Server 2.4.67 Patches RCE Flaw CVE-2026-23918 — Upgrade All Servers Immediately
Apache has released HTTP Server 2.4.67, patching five vulnerabilities including a critical double-free bug CVE-2026-23918 (CVSS 8.8) in the HTTP/2 implementation that can enable Remote Code Execution. All administrators running version 2.4…
Critical Android Zero-Click Vulnerability CVE-2026-0073 Allows Remote Shell Access Without User Interaction
Google has disclosed a critical zero-click remote code execution vulnerability tracked as CVE-2026-0073 in the Android System component. The flaw allows attackers on the same local network to gain shell-level access to vulnerable devices ru…
AccountDumpling: Vietnamese Phishing Ring Abuses Google AppSheet and Telegram to Harvest 30,000 Facebook Accounts
A sophisticated phishing operation called AccountDumpling has compromised around 30,000 Facebook accounts by routing lures through legitimate platforms including Google AppSheet, Netlify, and Vercel to bypass email security controls. Discov…
Microsoft Defender False Positive Quarantines DigiCert Root Certificates, Risks Breaking SSL Across Enterprise Networks
A faulty Microsoft Defender antimalware definition update incorrectly flagged two legitimate DigiCert root certificates as malware, automatically quarantining them from the Windows trust store on enterprise endpoints. The incident risked br…
Email Bombing and Fake IT Support on Microsoft Teams: How Attackers Are Stealing Remote Access
Attackers are combining inbox-flooding email bombing with fake IT support personas on Microsoft Teams to trick employees into granting remote access, leading to confirmed data exfiltration. Groups including Scattered Spider have adopted the…
FreeBSD DHCP Client Flaw CVE-2026-42511 Allows Root Code Execution via Rogue DHCP Server
A critical vulnerability in the FreeBSD DHCP client, CVE-2026-42511, allows attackers on the same local network to execute arbitrary commands as root by injecting malicious directives through a rogue DHCP server. All currently supported Fre…
KidsProtect: New Rebrandable Android Stalkerware Platform Lets Anyone Resell Covert Surveillance Malware
A new Android spyware tool called KidsProtect is being sold on hacking forums with a white-label reseller model that lets buyers rebrand and resell it under their own name — a business model specifically designed to survive law enforcement…
Exim 4.99.2 Patches Four Vulnerabilities Including Heap Corruption, DNS Crash, and Memory Leaks
The Exim development team has released version 4.99.2 to fix four security vulnerabilities — including a DNS-triggered crash on musl systems (CVE-2026-40684), heap corruption via malformed JSON (CVE-2026-40685), UTF-8 memory leaks (CVE-2026…
Trellix Source Code Breach: Hackers Gain Unauthorized Access to Internal Repository of Major XDR Vendor
Cybersecurity vendor Trellix has confirmed unauthorized access to part of its internal source code repository. The company says no evidence of product tampering or active exploitation has been found so far, but the investigation is ongoing…
APT Campaign Exploits cPanel CVE-2026-41940 to Breach Government and Military Servers Across South-East Asia
A sophisticated threat actor has exploited the critical cPanel authentication bypass CVE-2026-41940 to compromise government and military servers across South-East Asia, while also deploying a custom zero-day SQL-to-OS exploit against an In…
DEEP#DOOR: New Python Backdoor Silently Harvests Browser Passwords, Cloud Tokens, SSH Keys, and Wi-Fi Credentials
Securonix researchers have documented DEEP#DOOR, a self-contained Python backdoor delivered via obfuscated batch files that systematically disables Windows defenses before establishing persistent remote access. Its credential-harvesting eng…
China-Aligned SHADOW-EARTH Deploys ShadowPad, IOX Proxy, and WMIC in Multi-Stage Espionage Campaign Across Asia
A China-aligned threat group has conducted a prolonged espionage campaign against government agencies and critical infrastructure across eight Asian countries. The attackers used ShadowPad delivered via DLL sideloading, IOX proxy tools, WMI…
cPanelSniper PoC Exploit Released for CVSS 9.8 Flaw CVE-2026-41940 — 44,000 Servers Already Compromised
A public proof-of-concept exploit framework called cPanelSniper has been released for CVE-2026-41940, a CVSS 9.8 authentication bypass in cPanel and WHM. Over 44,000 servers have already been compromised, with exploitation traced back to Fe…
CORDIAL SPIDER and SNARKY SPIDER Deploy AiTM Pages to Breach SharePoint, HubSpot, and Google Workspace
Two threat groups are deploying adversary-in-the-middle phishing pages combined with voice phishing to bypass MFA and hijack enterprise SaaS sessions. Operating entirely within trusted cloud environments, the campaigns steal data at speed w…
VECT 2.0 Ransomware Permanently Destroys Files Over 128 KB Due to Encryption Flaw
A critical encryption bug in VECT 2.0 ransomware permanently destroys all files larger than 128 KB rather than encrypting them, making recovery impossible even after paying the ransom. The malware targets Windows, Linux, and VMware ESXi env…
Phoenix PhaaS Platform Weaponizes SMS to Impersonate Banks, Telecoms, and Delivery Firms Worldwide
A new Phishing-as-a-Service platform called Phoenix has been linked to over 1,500 phishing domains since early 2024, running large-scale smishing campaigns that impersonate banks, mobile operators, and logistics companies across more than 7…
Qilin Ransomware Adopts Stealthy RDP History Enumeration to Map Victim Networks
The Qilin ransomware group, responsible for over 700 attacks in 2025, has been observed using a stealthy PowerShell technique to enumerate RDP authentication history on compromised servers — silently mapping networks for lateral movement wi…
Critical Wireshark Update Patches 40+ Vulnerabilities Including Remote Code Execution Flaws
Wireshark 4.6.5 addresses over 40 security vulnerabilities, including critical RCE flaws in TLS, RDP, and SBC dissectors. Organizations running Wireshark in enterprise or SOC environments should update immediately to mitigate the risk of ar…
Lazarus Group Targets macOS Users With Sophisticated “Mach-O Man” Four-Stage Malware Kit
North Korea’s Lazarus Group has deployed a new modular macOS malware kit called “Mach-O Man” targeting fintech executives and crypto developers. The attack uses ClickFix social engineering to trick victims into running a terminal command th…
Linux Kernel Zero-Day “Copy Fail” (CVE-2026-31431) Grants Root Access on Every Major Distro Since 2017
A newly disclosed Linux kernel zero-day dubbed “Copy Fail” (CVE-2026-31431) allows any unprivileged local user to obtain root access on virtually every major Linux distribution since 2017 using a 732-byte Python script. The flaw affects ker…