Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

US Lawmakers Raise Alarm Over Alleged Hacking by India-Based Firms

Three Indian-based companies have been accused of conducting hacking campaigns and stealing data from thousands of Americans and US business...

All the recent news you need to know
vulnerabilities and exploits
acronis cPanel CVSS Cyber Security Linux sensitive data system files vulnerabilities and exploits

Acronis Discloses Actively Exploited Privilege Escalation Bug in Its cPanel Backup Plugin

 




Acronis has confirmed that attackers are actively exploiting a high-severity security flaw in its backup plugin for cPanel and WebHost Manager (WHM), urging system administrators to install available patches without delay.

The vulnerability, tracked as CVE-2026-87886 and rated high severity, allows local privilege escalation through insecure file permissions. Classified under CWE-276 (incorrect default permissions), the flaw affects Linux-based installations of the Acronis backup plugin and, if exploited successfully, could allow a threat actor to compromise system confidentiality, integrity, and availability. 

The flaw received its CVE designation on Tuesday, September 16, after Acronis quietly published a brief initial advisory over the weekend. The company assigned it a CVSS severity score of 7.8.


What the Plugin Does

To understand the risk here, it helps to know what this software actually sits on top of. The Acronis Backup plugin for WHM and cPanel gives hosting providers and web professionals cloud backup capabilities and granular, self-service recovery for end clients, including the ability to back up an entire cPanel server to cloud storage. 

Acronis is a cybersecurity and data protection technology company that is popular among web hosting providers and managed service providers, since its platform lets them offer backup and security to their clients under their own branding. Its backup add-ons connect cPanel and Plesk to Acronis' cloud infrastructure, letting administrators back up and recover sites, databases, and mailboxes. 

That puts the plugin in a particularly sensitive position on any server it runs on. An attacker who can escalate privileges inside this kind of environment has a direct path to the backup data of every customer account on that server.

The market footprint here is worth noting. According to the 2026 Web Hosting Trends Report by WebPros, cPanel/WHM leads the hosting control panel market with 64% adoption, while Plesk accounts for 31%. Both platforms are affected by this vulnerability, though active exploitation so far appears confined to cPanel and WHM deployments. 


How the Attack Works

CVE-2026-87886 stems from insecure file permissions and allows authenticated attackers to achieve local privilege escalation without any user interaction. The vulnerability's CVSS string indicates that it can be exploited in low-complexity attacks, meaning the attack does not require special conditions or circumstances beyond the attacker's control to succeed. 

In plain terms: an attacker who already has a low-level foothold on a vulnerable Linux server running this plugin can use this flaw to climb to higher privilege levels, without needing to trick a user or wait for any specific system event. Depending on the access gained, this could allow sensitive data to be accessed or modified and could potentially disrupt the server. 

The type of data at risk includes backup data, system files, and customer account data. 


Targeted Attacks, Limited Disclosure

Acronis' advisory language around the exploitation is measured but direct. The company stated that "exploitation of this vulnerability has been detected in the wild in limited, targeted attacks against Acronis Backup plugin for cPanel and WHM deployments." 

However, the disclosure comes with some important caveats. BleepingComputer reported that Acronis based that assessment on a single report from a potentially affected customer. That is enough to justify urgent patching, but it is not the same as evidence of broad, automated exploitation across hosting providers. 

There are currently no signs of active exploitation on Plesk deployments. Still, the extension for Plesk remains vulnerable and should be patched regardless. 

Acronis has not published detailed technical information about the flaw, saying it wants to give system administrators time to apply available patches before sharing further details. The company has also identified no specific indicators of compromise and has not disclosed when the activity occurred or what attackers achieved beyond the privilege escalation impact described in the advisory.


What Needs to Be Patched

Acronis pushed out security updates for the affected plugins before the CVE was formally assigned. The versions administrators need to be on are:

Acronis Backup plugin for cPanel and WHM builds earlier than 1.9.3.1021, now fixed in version 1.9.3 HF3, and Acronis Backup extension for Plesk builds earlier than 1.8.11.638, fixed in version 1.8.11. 

For shared hosting providers, the guidance is to check every server image and automation path, rather than assuming the version on one control-plane node represents the entire fleet. Once patched, administrators should also focus review on systems where initial access was plausible: servers hosting compromised sites, accounts with recent credential resets, and hosts that allow customers to upload or execute code. 

One additional note worth flagging: a cPanel or Plesk server without the Acronis plugin or extension is outside the scope of CVE-2026-87886. This is an Acronis integration issue, not a blanket advisory for every cPanel, WHM, or Plesk installation. 


Acronis is a Swiss cybersecurity company headquartered in Schaffhausen and operates a global network of cloud data centers, supporting over 20,000 service providers that protect approximately 750,000 businesses worldwide. That scale makes vulnerabilities in its hosting integrations a high-priority concern for the managed service provider community, where a single compromised server can cascade into customer data across dozens or hundreds of accounts. 

The company has not indicated whether it plans to release a more detailed post-mortem on the exploitation activity once patching rates improve, which is a common practice after actively exploited flaws. For now, the immediate priority is getting affected installations onto the fixed builds before whatever foothold attackers have found gets wider use.

Read more »
data security
AI Agent AI agent data theft AI technology Competition Watchdogs Cyberattacks Data Breach data security

Spanish Data Watchdog Publicises First AI Agent-Linked Data Breach Report

Spain's data protection watchdog said it has received the first reported notification of a personal data breach allegedly carried out by an artificial intelligence agent, a case suggesting autonomous systems are beginning to play a direct role in cyberattacks. The Spanish Data Protection Agency (AEPD) said in a blog post Monday that the incident involved an AI agent using a widely known large language model to identify vulnerabilities, gain access to a system, and subsequently modify personal data and access invoices. 

The agency said the alleged breach was reported by the affected organization and remains under review. It clarified that the use of a particular AI model does not imply the model itself or its provider's infrastructure was compromised, nor that the technology was built for malicious purposes. AEPD did not immediately respond to a request for comment and did not identify the large language model or the targeted organization. 

According to AEPD, the case is significant because a third party allegedly used an AI agent to carry out multiple stages of an attack with limited human intervention, underscoring the growing role autonomous systems are playing in cybersecurity incidents. The notification submitted by the affected organization indicated that the agent successfully logged into the system, autonomously searched for application weaknesses, and after identifying a vulnerability, altered personal information and viewed billing records. 

The incident emerges as regulators and cybersecurity authorities across the United States and Europe intensify scrutiny of risks posed by increasingly capable AI systems, even as businesses continue adopting the technology at a rapid pace. Spain has positioned itself as one of Europe's most vocal advocates for a "trustworthy AI" model — one that prioritizes protecting privacy, democracy, minors, and public safety over speed or industry profit. 

While AEPD acknowledged that a single case is insufficient to establish a broader trend, it said the notification suggests AI-assisted attacks are moving beyond the theoretical stage and beginning to affect real-world processing of personal data. The watchdog did not indicate when it would complete its review of the reported breach. 

AEPD noted that AI does not create fundamentally new threats but increases the speed, scale, and adaptability of existing malicious techniques, thereby reducing the time available to detect and contain them. The agency added that data controllers, processors, and data protection officers must prepare for a scenario in which the speed of attacks will continue to accelerate.
Read more »
macOS Security
Cyber Security cybersecurity vulnerability Intel Intel Security Linux Mac security updates macOS macOS Security

Homebrew 7.0.0 Ships With Fixes for Eight Security Advisories

 

Homebrew, a popular package manager for installing command-line tools and desktop apps on macOS and Linux, released version 7.0.0 on Sunday, with eight security advisories closed in the process. The most severe of the 18 reported issues is an unsigned removal metadata vulnerability for a cask, a formula in Homebrew's format for prebuilt app installs, allowing arbitrary sudo commands.

Homebrew removed the vulnerable recovery code and associated API accessors. Seven of the advisories were addressed in earlier 6.0.x releases, which means auto-updating machines already carry those fixes. The eighth is new and would let a malicious cask execute code outside the sandbox of a macOS via LaunchServices. Homebrew classified the issues as one High, two Moderate, and five Low. The High severity sudo path issue was fixed in 6.0.12, where a Moderate was also addressed for preventing the installer from reading Git config owned by the Homebrew prefix, which could run programs as root. 

The second Moderate is the LaunchServices escape mentioned earlier, which is fixed in 7.0.0 by restricting launching of applications, Mach services, and Unix socket connection. The five Low-level issues were fixed earlier and involved redirects and file paths pointing to unintended locations, including headers leaks, tap-restriction bypasses, and files being written outside of staged source trees. The new 7.0.0 brings a built-in scanner (`brew vulns`) that checks for known vulnerabilities in installed formulae, with flags such as `--severity=high` and `--fix-available` to narrow the results, against a database of known vulnerabilities in formulae versions that have been shipped. 

It includes backported fixes for some issues and minimizes false positives, with Homebrew's data on vulnerabilities being in the OSV format with a CC0 license and published through the Homebrew API. Provenance checks are now performed for third-party tap bottles, in addition to the Homebrew core tap, with new taps publishing these by default. Homebrew notes that tap trust remains the primary defense against malicious casks, with sandboxing not making "untrusted software safe to run" due to apps running with the user's privilege and a vendor's installer not running inside the sandbox. 

Nonetheless, 7.0.0 provides sandboxing of formula and cask operations, provides setup instructions as signed data instead of arbitrary Ruby code, and deprecates old post-install blocks in favor of declaring steps. On Linux, Bubblewrap sandboxing is replaced with Landlock, a new kernel feature that requires no additional dependencies. Intel Macs are moved to Tier 3 status following the end of reliable build infrastructure and cessation of routine Intel bottles, with support continuing until September 1, 2027, and MacPorts suggested as an alternative. macOS 10.15 is dropped with the release, while Sonoma 14 is moved to Tier 3.
Read more »
vulnerabilities and exploits
AMD Cloud Computing DDRop Google Hardware designs Intel TDX security researchers software vulnerabilities and exploits

A $159 Circuit Board Just Broke Cloud Computing's Strongest Security Guarantee

 




Security researchers have found a way to defeat the memory protections that Intel and AMD sell to cloud customers as their last line of defense against an untrusted host. The tool required costs less than a decent pair of headphones.

A team from KU Leuven, ETH Zurich, Durham University, and Google published details Sunday of an attack called DDRop, which exploits a fundamental design flaw in the memory encryption hardware powering confidential computing services at Amazon, Microsoft, and Google. It breaks protections in Intel Trust Domain Extensions (TDX), Intel Scalable SGX, and AMD Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP), the three technologies that allow cloud customers to run workloads that even the cloud provider cannot read.

The method does not require a software exploit. It requires a small custom-built circuit board, a brief window of physical access to the server, and knowledge of how DDR5 memory commands work. The researchers built their device for $159 in parts.


The Gap Nobody Patched

Confidential computing encrypts a server's working memory at all times. Even a cloud provider's own administrator sees only scrambled data. The problem DDRop exposes is that encryption is not the same thing as freshness. The processor can confirm that data in memory is encrypted. It cannot confirm that data is current. Stale data, so long as it was encrypted legitimately at some point in the past, will still decrypt correctly and raise no alarm.

DDRop turns that gap into an attack. A small interposer board sits between the processor and a DDR5 memory module. When the attacker wants to cancel a specific memory write, the interposer forces a parity error on the command bus. The memory module silently discards the write. The interposer then cuts the wire used to report that error, so the processor is never notified. Old data stays in memory. The system has no way to know the latest update never arrived.

This is the first active interposer attack to run on DDR5 at full bus speed. Earlier DDR5 research required slowing the memory bus down and could only listen passively. Previous active attacks that altered memory contents only worked on older DDR4 hardware, DDR5's redesigned command format blocked them. DDRop routes around that entirely by dropping writes rather than redirecting them.


What the Researchers Pulled Off

On an Intel TDX server, the team demonstrated four outcomes. By dropping writes to page tables during setup, they mapped an attacker's virtual machine onto any physical memory address, then read a victim machine's private memory in full. They also flipped a victim machine into debug mode, copied its memory in plaintext, and restored everything afterward with no trace of tampering.

The most consequential result was attestation forgery. Attestation is the mechanism a hospital or bank uses to verify that the virtual machine handling their data is the one they approved and has not been altered. With DDRop, an attacker's machine can pass that check as though it were a trusted one. A customer could be convinced they are talking to a secure, verified environment when they are not.

On AMD SEV-SNP, results were narrower the researchers copied the contents of one victim memory page into another but the underlying exposure is the same. Neither platform checks whether memory is fresh.


No Patch, No Timeline

Both Intel and AMD acknowledged DDRop through coordinated disclosure before publication and issued security advisories on September 14. Neither offered a mitigation timeline. Both drew the same line: because the attack requires physical access, it falls outside their published threat model for confidential computing. Intel said it will not assign a CVE.

The researchers are direct about why a software fix cannot solve this. The freshness check was deliberately left out. Scalable memory encryption trades freshness for the ability to protect the large amounts of memory that cloud servers require. A lasting fix would need new memory-encryption hardware capable of providing both integrity and freshness at scale. Intel has discussed a future proposal called cache-line versioning, but has not committed to a timeline and researchers say it is unclear whether it would stop DDRop anyway.

Short-term software measures restricting the memory management interfaces DDRop abuses, checking that critical writes completed, scanning for interposers at boot, can raise the bar without removing the root cause.


The researchers have no evidence DDRop has been used outside a lab. But the significance is what it proves is possible. Confidential computing is the technical promise that certain workloads stay private regardless of who owns the physical hardware. DDRop shows that promise has a physical boundary that can be crossed with $159 in components, a few minutes of access, and knowledge that a rogue data center employee, supply chain tamperer, or government compulsion order could all plausibly provide.

The full paper is scheduled for presentation at ACM CCS 2026 in November. Hardware designs, firmware, and proof-of-concept code are already on GitHub.

Read more »
Russia-Ukraine War
Gorilla RAT Hacking Cat malware Monkey Ransomware Russia-Ukraine War

Pro-Ukraine Hacking Cat Group Deploys New Malware Against Russian Targets

 

A pro-Ukraine hacktivist group known as Hacking Cat has significantly escalated its cyber operations against Russian targets by deploying newly developed malware, marking a strategic shift from simple website defacements to sophisticated data destruction campaigns. Researchers at Kaspersky uncovered two previously undocumented malware families—Gorilla RAT and Monkey Ransomware—being used in coordinated attacks that exploit server vulnerabilities and encrypt critical files across compromised networks. This evolution demonstrates how hacktivist groups are becoming increasingly capable of mounting technically advanced and sustained campaigns in the ongoing cyberwar between Ukraine and Russia. 

Hacking Cat first emerged around February 2024, initially focusing on low-impact operations such as defacing Russian websites and leaking stolen documents to embarrass adversaries and spread pro-Ukraine messaging. However, by summer 2025, the group began executing more destructive campaigns designed to encrypt and permanently destroy data on targeted systems rather than merely exposing information. This tactical evolution reflects a broader trend among Ukraine-aligned hacktivists, who are increasingly collaborating and sharing custom-built tools to maximize disruption against Russian infrastructure, state-linked organizations, and entities supporting Moscow's war efforts. 

The newly identified Gorilla RAT serves as a remote-access trojan that can tunnel network traffic, enabling attackers to move laterally within victim networks after exploiting vulnerabilities in Microsoft Exchange servers. Monkey Ransomware, which appends a ".monkey" extension to encrypted files, has appeared in multiple variants written in different programming languages since its debut in late 2025. Kaspersky researchers noted that the unusually rapid iteration of the ransomware could suggest the use of generative AI tools to accelerate malware development, though the hackers may also be experimenting with different coding approaches to evade detection and improve effectiveness against diverse targets. 

Joint operations and shared toolkits

Hacking Cat frequently coordinates with other pro-Ukraine groups, including the Cyber Anarchy Squad and the Ukrainian Cyber Alliance, to execute high-impact attacks that cause maximum disruption. In March 2026, the group claimed responsibility for breaching a contractor working for Rosatom, Russia's state nuclear energy corporation, demonstrating its ability to penetrate sensitive industrial networks. Later, in June, it participated in a destructive operation against Donbassteploenergo, a heating provider in Russian-occupied Donetsk, using Nemo Wiper—a tool designed specifically to erase data and disrupt critical infrastructure rather than collect ransom payments from victims. 

The sharing of malware among hacktivist collectives has complicated efforts to attribute specific attacks to individual groups, as multiple organizations now use identical multi-stage infection chains and custom-developed tools. Kaspersky's report linked several tools to Hacking Cat, but the group pushed back in a Telegram statement, acknowledging ownership of "a couple of the tools" while denying responsibility for the ransomware variants. Hacking Cat accused the cybersecurity firm of incorrectly associating unrelated malware with its operations and criticized the quality of its reverse-engineering analysis, highlighting the challenges researchers face in tracking decentralized hacktivist ecosystems. 

Despite these attribution disputes, the overlap in toolkits underscores a maturing cyberwar ecosystem in which Ukraine-aligned hackers are pooling resources, expertise, and custom malware to sustain pressure on Russian targets. The deployment of AI-assisted development tools, coordinated joint operations, and increasingly destructive capabilities signal that hacktivist groups are no longer peripheral actors but integral components of Ukraine's broader resistance strategy. As the conflict continues, cybersecurity experts warn that similar collaborations could emerge elsewhere, reshaping how non-state actors participate in modern warfare through digital means.
Read more »
VPN Vulnerability
Data Breach Government Data Breach Government Network Security Japan Cyber attack Japan Digital Agency Phishing Risk VPN Security VPN Vulnerability

Japan Digital Agency Data Breach Linked to VPN Vulnerability


Government Solution Service (GSS) of Japan's Digital Agency was compromised by a vulnerability in a VPN device, resulting in unauthorized access to the shared government platform through an exploit of a vulnerability in the VPN device. In this incident, 246,000 records containing information regarding employees, public officials, contractors, and other individuals connected to organizations using the service may have been exposed. 

Upon discovering unusually large-scale access to files on a server through an account belonging to a maintenance and operations staff member on June 25, the agency first detected the breach. Following an investigation, the agency determined that the account activity was linked to an unauthorized access to a network-connected VPN device. 

By July 9, the agency determined that an external party had accessed the system by exploiting a vulnerability in the VPN equipment. Immediately after the incident, the maintenance account was suspended, and communication between the equipment and external networks was restricted to prevent further access. 

The investigation, conducted with the assistance of an external security company, revealed that some files that contained personal information could have been transferred outside the system. The VPN product used and the specific vulnerability that was exploited have not been disclosed by the agency. Through shared IT infrastructure, 23 Japanese ministries and government agencies are served by the affected GSS environment, which can have a greater impact on the incident. 

The exposed information consists of approximately 236,000 names, 231,000 e-mail addresses, 94,000 telephone numbers, and 1,000 physical addresses. The records relate to personnel and officials who work with GSS user organizations, as well as businesses and individuals who support those organizations. 

Data containing information belonging to the general public was not included in the affected data, according to the agency. Additionally, the compromised dataset is lacking My Number identification numbers, bank account information, or pension number information. Despite the fact that no confirmed cases of misuse have been identified, the exposed contact information could still be used for impersonation, phishing, or other forms of social engineering. 

VPN exposures were categorized as medium severity and were not zero-day vulnerabilities; however, the agency has failed to provide details regarding when the vulnerability was fixed or why the device was still exposed at the time of the intrusion. 

Known VPN Flaw Left Unpatched

Due to the fact that the Digital Agency was already aware of a VPN flaw when the breach occurred, but had not applied the required patch, the incident raises concerns about vulnerability management. According to the agency, the vulnerability has a medium severity and has been confirmed as not a zero-day, indicating that attackers exploited a known vulnerability rather than a newly discovered vulnerability. 

The information accessed is approximately 246,000 records. Over 189,000 of these people are government employees, public officials, or other personnel working for GSS-related organizations, while approximately 57,000 are private companies and individuals involved in government-related activities. 

A total of 236,000 names, 231,000 emails, 94,000 telephone numbers, and 1,000 physical addresses were included in the data. In addition, duplicate entries may be present in the data. More sensitive identifiers are not included in the dataset, such as My Number information, bank account details, and pension information.

Investigation Finds No Confirmed Misuse

The Digital Agency has not received any confirmations of misuse of the exposed information, however, the combination of names and contact information could facilitate targeted phishing or impersonation attempts against affected employees. Messages or phone calls from individuals pretending to represent the government have been warned by the agency, and official personnel will not contact affected parties via email or telephone for passwords or payment information. 

Japan's Personal Information Protection Commission was made aware of this incident on July 15. During the investigation, the agency determined that potentially affected information was likely to be identified and the individuals and organizations involved required a considerable amount of time, which contributed to the delay in public disclosure. 

Digital Agency officials indicated the impact was limited to the affected GSS environment with no evidence of other government systems being compromised or disrupted. As part of its effort to strengthen vulnerability management and review how external connections to the system are handled, the agency is also expected to provide direct notifications to the affected individuals. 

To prevent unauthorized access to sensitive government information and limit unauthorized access, VPN patches should be implemented on time, strict access controls should be implemented, continuous monitoring should occur, and rapid isolation should be instituted.
Read more »
Subscribe to: Posts (Atom)

Featured