Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Vulnerabilities and Exploits
AI Anthropic CVE PostgreSQL SQL Vulnerabilities and Exploits

PostgreSQL’s Largest Ever Security Release Patches 52 Flaws, Including a 22-Year-Old Bug Any Logged-In User Could Weaponize

 


The PostgreSQL Global Development Group shipped security updates on November 12 for all five supported major versions, issuing fixes for 52 vulnerabilities at once: the largest security release the project has published. Thirty-two of the 52 flaws carry a CVSS 3.1 score of 8.8, with no user interaction required, full confidentiality and availability impact, and network reachability through a low-privilege login. The fixed releases are 18.7, 17.12, 16.16, 15.20, and 14.25.

At the center of the batch is CVE-2026-6460, a type confusion flaw in how PostgreSQL handles composite types — data structures built from named fields. When a field's type is changed after values of the original type are already stored, PostgreSQL's binary representation keeps those old bytes intact while the catalog metadata shifts around them. The server then reads a stale value through the new type's output function. That mismatch is enough for a database user who can create objects to run arbitrary code as the OS account running PostgreSQL, no superuser status, no extensions, no file access.

The trigger takes exactly four SQL statements. A user creates a composite type, prepares a query using it, alters the attribute to a different type, then executes the prepared query. The backend selects the wrong output handler, dereferences a null pointer, and crashes. That crash is the entry point.

Security researcher Mehmet Ince found the flaw and published a writeup alongside a demonstration on PostgreSQL 18.6. He traces the root cause to a commit made May 5, 2004, the one that added ALTER TABLE ... ALTER COLUMN ... TYPE. That logic never accounted for prepared statements holding values built against the old type. The code sat there for 22 years. His exploit chain defeats ASLR through a related confusion involving PostgreSQL's unnest() function, then calls system() through a forged object whose methods table points at the system call. He stopped short of publishing that final step. He found 21 variants of the problem in total, and six of the 52 CVEs in this release trace to his work. The release credits 18 researchers for CVE-2026-6460 alone, including PostgreSQL core developers Heikki Linnakangas and Andres Freund, along with the OpenAI Security Research Team and the Anthropic OSS program.

Before going public, Ince spent August coordinating with every major managed provider. He shared working proofs of concept with AWS covering both Aurora and RDS, Microsoft for Azure Database for PostgreSQL, Google for AlloyDB, Supabase, Databricks, and Ubicloud. Google AlloyDB escalated the report to its highest internal priority. Databricks validated the exploits the same day they arrived. Several vendors deployed their own mitigations before the upstream release shipped. Their current patch status is not public, so administrators on managed services should verify the minor version their provider is running.

The release also contains a flaw that skips authentication entirely. CVE-2026-116322, rated 5.3, lets any client restart a PostgreSQL 18 server without logging in. It involves a cancel request and a spinlock held during the authentication timeout window. Two further vulnerabilities sit in the client tools: a crafted archive fed to pg_restore can execute code as whoever invoked it, and a compromised source server can inject commands through the restore script inside pg_dump's tar output to any psql client connecting to it.

The November release permanently closes the PostgreSQL 14 branch. Version 14.25 is its last update. Administrators still on that version are running unsupported software from today. PostgreSQL 15 reaches the same status in November 2027.

Upgrading involves more than swapping binaries. The fix for CVE-2026-6460 changes the server's internal ABI for C-language extensions, which must be rebuilt against the patched version. Extensions compiled for the new release will not load on an unpatched server, so the upgrade and the rebuild must happen together. A new server setting, composite_type_mismatch, enables the type-version checks behind the fix; the project says disabling it carries security risk. Client tools must be updated on every machine running them, not just servers. Clusters managed by Patroni or any custom service unit need a manual restart. Users of incremental backups should take a new full backup before anchoring further incrementals. No workaround exists for the principal vulnerability on servers that cannot be patched, and PostgreSQL has reported no attacks in the wild.

The same acknowledgment list that names Ince, Linnakangas, and Freund also includes AI-assisted tooling. That dynamic cuts both ways. PostgreSQL 19, normally shipped in September or October, was pushed to November 19 partly because AI and LLM tools generated enough new reports to overwhelm the maintainers' review capacity before the feature freeze. Developer Robert Haas noted that LLM-drafted patches still need human review to meet project standards, and consultant Christophe Pettus pointed to the volume of low-quality machine-generated reports as a growing burden. The same tools that surfaced a 22-year-old bug made it harder to ship the next version.


Read more »
Malicious calls
Cyber Attacks cyber espionage Cyber Security and Privacy Device Security Fraudulent Message Hacking Attack Malicious calls

SilentAir Hacks Asian Telecom Networks to Intercept Calls and SMS Verification Codes

 

A cyber espionage group known as SilentAir has been attacking telecoms infrastructure throughout Asia to listen in on selected individuals’ calls and text messages. This was uncovered by Enea, a telecom security firm based in Stockholm. They believe with high confidence that the campaign is state-sponsored, however it is uncertain how connected it is to China. Enea were able to trace the attacks to compromised devices within mobile operators in at least 6 countries throughout Asia. 

They have informed the operators but cannot confirm that all devices are now clean. SilentAir attacked the trust between mobile networks using the SS7 and Diameter protocols to communicate. This communication occurs on the IPX network which links all operators together. They sent false UpdateLocation messages to the compromised devices claiming they were the serving network for targeted users. When this was accepted calls and texts were redirected towards the attacker. Whilst they were intercepting some calls, Enea were able to see SMS 2FA codes being captured straight after the redirection. This suggests they were trying to breach other accounts for their victims. 

However during their investigation there was no confirmation that they were able to take over any accounts, nor was there any evidence of voice calls being intercepted. Intercepting calls made up 18.3% of the attacks they observed compared to only 2.1% from their previous research into common signalling attacks. There were many high value targets such as political and government individuals. 

In some cases multiple compromised devices were used across different countries to target the same individuals suggesting there was some central control. The attacks occurred in short bursts. At times thousands of subscribers were targeted but then nothing happened for months. Whilst the main focus was Taiwan, networks across Southeast Asia, East Asia, East Africa, Central Asia, Middle East and Europe were also targeted. 

There was a large amount of silent SMS being used. Many targeted Taiwanese subscribers during the evening, potentially to check if the redirection was working. Many were sent during the day to subscribers on other networks. The messages had generic English text relating to promotions and motivation, so could have been seen as spam if the silent settings were turned off by the operators. Enea started to see strange signalling activity in early 2025. 

Eventually they were able to see compromised devices sending and receiving attack commands confirming that the operators internal infrastructure had been compromised. They looked into potential links with another telecom focussed threat group called Liminal Panda but there wasn’t enough evidence to connect them. SilentAir also had similarities to SCTPE, a Linux based tool used to manage SS7 and Diameter traffic. This has been referred to as SIGweaver within a government advisory from Singapore. 

However the capabilities differ and there was not enough operational security to link them. Liminal Panda activity was also detected by Enea across multiple customer networks in early 2026. They blocked GTPDoor backdoor traffic across at least 5-10 operators. The new version of this is harder to detect as it hides the commands within GTP-U traffic.

Enea recommend using GTP-C and GTP-U firewalls, treating all IPX connections as untrusted and ensuring telecom monitoring is brought into the wider IT security.
Read more »
StealC
CastleRAT GootLoader Malware Operation Endgame StealC

Operation Endgame Takes Down Three Malware Networks, Recovers 6.4 Million Stolen Logins


An international law enforcement operation has shut down the infrastructure behind three major malware operations: Gootloader, CastleRAT and StealC, seizing 235 servers and 257 domains used by cybercriminals to distribute malicious software, steal sensitive information and support ransomware attacks.

Operation endgame disrupts three major malware networks

The coordinated action, conducted as part of Operation Endgame, also resulted in the identification and seizure of approximately 6.4 million stolen login credentials belonging to victims worldwide. According to Germany's Federal Criminal Police Office (BKA), the credentials were associated with more than 40,000 victims.

Gootloader spread malware through compromised websites

Gootloader is a malware loader that enables attackers to gain initial access to compromised computers and subsequently install additional malicious programs, including ransomware. Its operators distributed malware through fake legal documents hosted on compromised websites, frequently exploiting hacked WordPress sites.

The attackers also used search engine optimisation (SEO) poisoning to manipulate search results and direct unsuspecting users towards malicious downloads. 

Since 2018, Gootloader has infected at least 25,000 computers worldwide, according to the U.S. Department of Justice. In the United States alone, the malware has been linked to ransomware attacks against at least 44 victims, resulting in estimated losses of approximately $28.8 million.

As part of the operation, authorities dismantled 14 servers and 218 domains associated with Gootloader and cleaned 681 compromised websites.

Castlerat and stealc enabled remote access and credential theft

The investigation also targeted CastleRAT, a remote access trojan that allows attackers to remotely control infected systems and use them for malicious activities. Authorities seized 120 servers and 39 domains linked to the operation.

Meanwhile, StealC, an information-stealing malware, was another major target. The malware is designed to extract sensitive information, including passwords, stored credentials and digital identities, from compromised computers. 

This latest disruption follows an earlier law enforcement action against StealC in June 2026. Following that operation, its operators reportedly rebuilt their infrastructure and resumed activities to evade investigators.

Europol's European Cybercrime Centre (EC3) supported the investigation through cyber intelligence, financial tracking and victim identification. Authorities also plan to make information about affected users available through several cybersecurity platforms, including Have I Been Pwned, and the Shadowserver Foundation.

Although no arrests were announced during this latest action, Dutch authorities have continued investigations targeting Gootloader's suspected main operator.

Read more »
UTA Data Breach
Data Breach Higher Education Cybersecurity Qilin Ransomware Ransomware Attack Student Data Theft University Cybersecurity University Of Texas At Arlington Cyberattack UTA Data Breach

Hackers Steal Personal Information in Cyberattack on University of Texas at Arlington


UTA has confirmed that hackers have stolen personal information as a result of a cyberattack last month that affected its IT environment. A university investigation into unauthorized activity has led to this disclosure, although the university has not yet determined the full extent of the data exposure or identified all individuals whose information may have been compromised as a consequence of the data exposure. 

During a response to Recorded Future News, a university spokesperson confirmed the investigation identified data theft, but did not provide specific details regarding which types of information were accessed by the attackers. As part of the university's ongoing efforts to determine the scope and nature of the compromised data and identify potentially affected students and employees, we are currently conducting research. 

According to UTA, individuals who are identified as affected will receive notifications describing the incident, the information involved, and the methods available for protecting their personal information. In addition, the university plans to provide support and guidance to individuals whose information has been exposed. 

In the initial phase, the incident was noticed following disruptions involving MachForms, an online platform used for registrations, service requests, surveys, and other administrative functions. UTA immediately took the platform offline as a precautionary measure following the discovery of the security incident. 

While the investigation continues, MachForms will remain unavailable. The university has also monitored its IT environment to detect any further impacts on its systems or daily operations. There has been no specific timeline provided for the restoration of the affected service. With approximately 41,000 undergraduate and graduate students, The University of Texas at Arlington is one of the most prestigious higher education institutions in Texas. 

It is alarming to learn that personal information belonging to academic and administrative members of the university was stolen, raising concerns about the possibility of sensitive data being exposed. A ransomware attack was claimed earlier this week by the Qilin ransomware group. Qilin has established itself as one of the most active ransomware groups targeting a variety of industries. 

Halcyon Ransomware Research Center figures indicate that between July and September 2026, the group is believed to be linked to 344 alleged ransomware incidents, placing it among the top ransomware operators at that time. In addition to the recent arrest of one of the ransomware operation's prominent affiliates in Japan and extradition to Germany, Qilin has also been attracting attention as a result of a series of developments involving its affiliates and leadership. 

The Russian national Aleksey Mikhailovich Yakovtsev has been identified as a leader of the ransomware network by cybersecurity companies and independent researchers, adding to ongoing investigations into the individuals behind the ransomware network. In addition to claiming responsibility for attacks on the US Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF), the group has also claimed responsibility for attacks on government and institutional targets in the past few months. 

Using its double-extortion strategy, the organization threatens to publish the stolen files if victims refuse to pay ransom. These tactics increase the workload on organizations, particularly those that handle large volumes of personal and administrative information. This incident occurs during a period when higher education institutions are experiencing a series of ransomware attacks. 

According to York University's recent announcement, attackers have accessed and taken substantial amounts of student information, including more than a decade of student records. Besides raising concerns about the long-term exposure of personal information maintained by academic institutions, Vanderbilt University has also suffered from a separate ransomware attack which has adversely affected its operations. 

University officials have advised that it may take several weeks to restore normal operation across the university's systems. The university's efforts to recover are concentrating on essential services such as payroll, payment processing, admissions, course registration, and public safety. Vanderbilt remains under investigation for possible data theft. 

A group responsible for BYOD ransomware has claimed responsibility for the incident at Vanderbilt, as well as recent attacks that affected Michigan State University and New Mexico University. Newly emerging groups and their operations are relatively unknown to researchers. There has been an increasing number of attacks against universities, which have highlighted the risk faced by educational institutions that maintain extensive student, employee, and administrative databases. 

Having disruptions to academic services, combined with unauthorized access to personal data, can adversely affect institutions and their communities for a long period of time. Immediately, the top priority at UTA is determining the scope of the breach, identifying those affected, and restoring the impacted services in a secure manner. 

As higher education institutions manage large quantities of sensitive student and employee data, cybersecurity risks are becoming increasingly important. As UTA continues to assess the extent of the breach and identify affected individuals, this case illustrates the importance of strengthened data protection measures, timely incident response, and continuous monitoring of university information technology systems. 

As well as reflecting the persistent threat that ransomware groups pose to educational institutions, Qilin's involvement also demonstrates the possibility of long-term consequences when disrupting operations and revealing data.
Read more »
third party breach
Baker Tilly Customer Data Data Breach notification Ransomware third party breach

Baker Tilly Discloses Third-Party Data Breach Affecting Nearly 196,000 Individuals

 



Baker Tilly Advisory Group has begun notifying clients about a data breach involving an external service provider, after an unauthorized actor obtained personal information belonging to certain clients and their dependents.

The compromised information was stored on a platform operated by a third-party provider that Baker Tilly uses to deliver its client services. According to the company's notification letter, Baker Tilly discovered the incident on September 6, 2026, and completed its review of the affected records on October 28, identifying the individuals whose information had been exposed.

In its notification, Baker Tilly stated that it became aware of a potential cybersecurity incident involving information maintained on the third-party platform. The company subsequently confirmed that an unauthorized party had obtained data associated with some of its clients.


Nearly 196,000 Individuals Reportedly Affected

Although Baker Tilly's notification does not disclose an overall number of affected individuals or identify the third-party service provider, regulatory disclosures provide further details about the incident's scale.

A filing submitted to the Texas Attorney General's Office lists 10,456 affected Texas residents. The disclosure identifies individuals' full names, addresses, Social Security numbers (SSNs), and other information among the compromised data categories.

The same filing reportedly records a nationwide impact of 195,512 individuals. Additional state disclosures include 1,359 affected residents in South Carolina and 2,689 in Massachusetts. However, the company has not independently provided a consolidated figure in its customer notification.

The sample notification letter published through state regulatory disclosures also contains an unfilled placeholder where the specific categories of compromised personal information should appear. Consequently, the Texas filing currently provides the clearest publicly available breakdown of the exposed information.


Baker Tilly Investigates Third-Party Security Incident

Following the discovery, Baker Tilly says it initiated containment measures and engaged external cybersecurity specialists to investigate the incident, establish its scope, and determine which information had been accessed. The company also notified law enforcement authorities and stated that it is cooperating with their investigation.

Baker Tilly maintains that its investigation has found no evidence of continued unauthorized access to its own network or systems. It has also reported no known instances of identity theft or fraud connected to the compromised information.

However, the absence of reported fraudulent activity does not establish that the exposed information cannot be misused in the future, particularly where government identification numbers and residential information are involved.


Affected Individuals Offered 24 Months of Experian Protection

To address potential consequences of the exposure, Baker Tilly is providing affected individuals with complimentary access to Experian IdentityWorks for 24 months.

According to the notification letter, the package includes credit monitoring, identity restoration assistance, and access to specialists who can help investigate and resolve identity theft incidents. The membership also includes up to $1 million in identity theft insurance, subject to the applicable policy conditions and exclusions.

The company has advised recipients to monitor their financial statements and credit reports for unfamiliar transactions or other suspicious activity.


Baker Tilly's Global Operations

Baker Tilly provides accounting, auditing, tax, consulting, and business advisory services. Its international network reported annual revenue of $6.8 billion for the financial year ending December 31, 2025, representing a 21.3% increase over the previous year.

According to its January 2026 financial announcement, the network comprises more than 50,400 professionals operating across 147 territories and 754 offices.

The company has not publicly identified the compromised service provider or explained how the unauthorized actor gained access to its platform. BleepingComputer also reported that it had contacted Baker Tilly seeking clarification about the incident, affected customer numbers, and compromised information but had not received a response at publication time.

No ransomware group had publicly claimed responsibility for the incident at the time of reporting.

Read more »
Supply-Chain Attack
Credential Theft Cyber Attacks GitHub Supply-Chain Attack

Massive GitHub Supply-Chain Attack Exposes Secrets in 1,800+ Repositories

 

A large-scale software supply-chain attack has compromised thousands of GitHub accounts and exposed secrets across more than 1,800 repositories. According to Aikido Security, an attacker used stolen credentials to gain write access to GitHub accounts and planted a malicious continuous-integration (CI) workflow designed to steal cloud credentials, tokens, and other sensitive information. The malicious code was inserted into repositories and often removed within minutes, making the incident difficult to detect. The campaign demonstrates how compromised developer accounts can be weaponized to attack the software supply chain, potentially affecting organizations far beyond the initially targeted repositories. 

The attackers reportedly gained control of 4,837 hijacked GitHub accounts and used their write permissions to insert a secret-stealing payload into repositories. The malicious workflow ran in at least 1,806 repositories, meaning credentials and cloud roles accessible to those repositories’ CI pipelines should be treated as compromised. The campaign began with seemingly harmless pull requests titled “docs: dependency audit notes,” submitted from branches named wfx-docs. These requests were opened in 61,764 repositories, apparently to test whether the compromised accounts could write to them, before malicious commits were added to a smaller group of targets. 

A separate analysis by SafeDep identified 8,093 public repositories that received malicious commits between 12:46 UTC on Tuesday and 04:36 UTC the following day. Because the researchers examined only default branches of public repositories, the actual number of affected repositories is likely higher. In 7,309 repositories, the attacker added the stealer to an existing GitHub Actions workflow. In another 771 repositories, it was inserted as an npm postinstall hook, which could execute on a developer’s machine when they ran npm install. After deploying the payload, the attacker frequently reverted the changes within minutes and deleted workflow logs, sometimes removing the workflow run entirely. 

The malware collected a broad range of sensitive material from CI runners, including GitHub Actions secrets and variables, the workflow’s GITHUB_TOKEN, OIDC and runtime tokens, AI-service keys, and credentials stored in process memory. It also searched for credential files associated with AWS, Azure, Google Cloud, Kubernetes, npm, PyPI, and SSH. The attack was not limited to stealing short-lived tokens: researchers found that the malware could exchange GitHub OIDC tokens for AWS, Google Cloud, and Azure sessions, potentially allowing the attacker to move deeper into cloud environments.

On AWS, the stealer could create long-lived access keys for IAM users and rewrite a role’s trust policy to make it accessible from other AWS accounts. In Azure, it could add federated identity credentials prefixed with wfx-ci- to Entra ID applications, allowing workflows to authenticate even after original tokens were rotated. Repository owners should search for suspicious branches such as wfx-docs, ci-check-[0-9]{4}, and short-lived chore/ branches. They should also look for pull requests titled “docs: dependency audit notes” and commits labeled ci: refresh build cache, chore: add ci helper, ci: restore, or ci: cleanup. 

Other indicators include unexpected workflow files, a .ci-xxxxxx.sh script, an npm postinstall hook, and the SHA-256 hash 89695abb392d5cfd4972672961e644bb46baa98aa1ed7173c2a2816c762735cf. Affected repository owners should immediately revoke the compromised account’s tokens, OAuth grants, SSH keys, and active sessions, then enable two-factor authentication. They must also rotate every secret, variable, cloud credential, and API key that the affected repository or CI workflow could access. Developers who ran npm install on an affected commit should treat their machines as compromised and rotate local keys and credentials. 

Organizations should also review GitHub Actions permissions, restrict workflow access to secrets, require approval for changes from outside collaborators, and monitor cloud logs for suspicious identity activity. This incident highlights that developer accounts, CI systems, and cloud identities are now primary targets in software supply-chain attacks, making strong authentication, least-privilege access, secret rotation, and continuous monitoring essential defenses.
Read more »
Malicious Code
Apache Apache Server Attack Apache Vulnerability Critical security flaw Cyber Security HTTP HTTP Attacks Malicious Code

Apache HTTP/2 Security Flaw Exposes Servers to Critical Remote Code Execution Attacks

 

A new vulnerability in Apache HTTP Server could allow an attacker to run malicious code remotely on vulnerable systems. The vulnerability, tracked as CVE-2026-119618, affects the HTTP/2 module (mod_http2) and has a CVSS score of 9.8 which means it is critical. This has been fixed in Apache version 2.4.71 which was released on the 11th November 2026. 

The Apache versions affected are between 2.4.55 and 2.4.70. However, only systems where HTTP/2 has been enabled are vulnerable. Red Hat state "An attacker with network access to a vulnerable system could exploit this vulnerability to take control of the server process." As no authentication is required systems that are network accessible could be at high risk. Red Hat’s analysis of the vulnerability states that there is public research showing a reliable exploit for a server running the default configuration and mod_http2 enabled. The research was not detailed or sourced. 

However, cybersecurity firm Wiz state that there is no exploit available and no attacks have been observed in the wild. HTTP/2 is not enabled by default. It can be enabled globally for all virtual hosts or just on specific virtual hosts. This is done by adding ‘h2’ to the Protocols directive for secure HTTP/2 (TLS) or ‘h2c’ for insecure HTTP/2 (TCP). All configuration files should be reviewed by the security team. Apache recommend upgrading to version 2.4.71. This also includes a fix for a crash issue in mod_md (Important) and a memory overwrite vulnerability in mod_vhost_alias (Low severity). If you are using official builds of Apache then administrators should upgrade to the latest version. This also affects standalone versions of the HTTP/2 module (mod_h2). 

These versions affected are between 2.0.8 to 2.0.42. There is no fixed version available. The GitHub repository has been archived and the latest version published is 2.0.42. The patch is available for some OSs. Red Hat have patched Enterprise Linux versions 9 and 10. However, this vulnerability is rated as Important. This is because the HTTP/2 streams use separate memory allocators making it harder to exploit. Enterprise Linux 8 and below are unaffected. Debian have patched this in their unstable version. Bookworm, trixie and forky are still affected. 
Amazon Linux 2, 2023 and 2027 Preview are waiting on patches. Ubuntu do not have a specific vulnerability page.  
If you cannot patch your systems then Wiz recommend disabling HTTP/2 by removing ‘h2’ and ‘h2c’ from the Protocols directive. This will leave you with HTTP/1.1. This vulnerability was first reported by Anthropic’s OSS Scanner on the 26th October. The scanner uses Anthropic’s AI models to scan open source software. It was also reported by Anthony Weems and Simon Scannell from Google Cloud Vulnerability Research last week. This comes after another vulnerability in Apache’s HTTP/2 module (CVE-2026-23918) was patched in version 2.4.67 in May. Upgrading to this version or any version after up to 2.4.70 won’t protect your systems from this new vulnerability.
Read more »
Red Hat
Critical Flaw Cyber Security Hacking Private Container Images Red Hat

Critical Red Hat Quay Flaw Could Allow Attackers to Steal Private Container Images


A critical security vulnerability in Red Hat Quay, an enterprise container registry platform, could allow attackers to access private container images, modify repository contents and maintain persistent access to affected systems. 

Tracked as CVE-2026-123710, the flaw carries a CVSS severity score of 9.8 out of 10, placing it in the critical category. According to Red Hat, the vulnerability affects deployments in which the service responsible for managing signing keys is accessible to untrusted clients.

The vulnerability exists in Quay's service key server, which manages the cryptographic keys used to sign registry access tokens. These tokens determine whether users and applications can download or upload container images.

According to Red Hat's security advisory, an unauthenticated attacker can exploit weaknesses in the key rotation mechanism to install an unauthorized signing key that the registry automatically trusts. When anonymous access is enabled, an attacker can obtain a registry token and use it to manipulate the key rotation process.

Once the malicious key has been installed, attackers can generate their own registry tokens with read and write permissions across repositories. This allows them to access private container images belonging to other users or organizations without following the platform's normal access restrictions.

According to Red Hat's Bugzilla report, "rotation also deletes the legitimate instance key as a side effect, and the attacker key can delete replacement instance keys."

Beyond stealing images, attackers could also replace or overwrite repository contents. Such modifications could affect software development and deployment processes, particularly when automated systems download compromised images from the registry. Sensitive credentials and other secrets stored within container images could also be exposed.

Another scaring aspect of the vulnerability is the persistence of unauthorized access. The malicious signing key can be configured without an expiration date and remains active even after the registry is restarted. Red Hat also warned that attackers could use the compromised key to delete legitimate signing keys, potentially disrupting normal image uploads and downloads.

Disabling anonymous access does not completely eliminate the risk, as users with valid Quay accounts can also exploit the vulnerability. Similarly, changing account passwords or regenerating robot account tokens will not invalidate an unauthorized signing key.

Red Hat recommends administrators immediately restrict access to the key-management service.

Red Hat cautioned that removing malicious keys alone may not provide lasting protection until a fixed version is installed, as attackers could potentially reinstall them.

The vulnerability was discovered by Red Hat researcher Dave O'Connor. Fixes for the issue were merged into the project's GitHub repository on November 11.

Read more »
Remote Access Trojan
Command And Control Cybersecurity Threats GSocket Exploitation GSocket Malware Linux Backdoor Linux Server Security Malware Persistent Access Remote Access Trojan

GSocket Backdoor Allows Hackers to Retain Remote Control Over Linux Servers


GSocket is a legitimate open-source remote access tool that is being exploited by multiple threat actors to remain undetected even after the vulnerabilities used to gain entry have been patched. As a result of this activity, attackers are developing independent access channels that remain active after the initial security breach, highlighting the growing post-compromise threat. 

Microsoft released a report on November 11, 2026 detailing malicious use of GSocket across Linux environments in significant numbers. Microsoft Defender for Endpoint telemetry reports a 356.2% increase in detections of GSocket-related attacks between March and August 2026. The attacks primarily affected internet-facing web applications as well as hosting infrastructure. 

As a networking utility, GSO sockets were originally developed to allow remote communication between systems behind firewalls and Network Address Translation (NAT) devices. As a result of these networking capabilities, attackers are establishing encrypted command-and-control connections via GSRNV through the Global Socket Relay Network in an attempt to exploit its capabilities. 

In contrast to conventional remote access methods, GSocket does not require attackers to directly access compromised servers. By establishing outbound connections to the shared relay network, both the infected host and the operator are able to communicate. In addition to eliminating the need for an exposed inbound port, a public IP address, or a dedicated C2 server controlled by an attacker, this communication model also diminishes conventional network defense capabilities. 

A firewall rule that identifies inbound connections cannot easily identify these connections, and blocking individual IP addresses or domains may not interfere with access as traffic passes through a shared relay system. However, egress filtering and outbound traffic monitoring can be useful for identifying or preventing suspicious communications. 

Most detected activities occur in web hosting environments

An analysis conducted by Microsoft determined that web applications and hosting environments contributed 87.1% to the number of incidents attributed to GSocket. PHP web applications and cPanel hosting accounted for 63.9% of incidents, while Apache environments contributed 24.3%. In conclusion, these findings indicate that internet-facing Linux infrastructure is a significant target of this activity. 

GSocket is typically downloaded and launched through shell commands by attackers using vulnerabilities in exposed web applications. Once deployed, the tool operates independently of the vulnerable application. As a result, patching the original security flaw or restarting the affected service does not terminate or remove the malicious client or terminate its access channel automatically. According to Microsoft, education and research organizations accounted for 30.7% of affected organizations, followed by technology and telecommunications with 22.9%. 

Attackers Establish Multiple Persistence Mechanisms

Following the initial compromise, Microsoft found that attackers used a number of methods to maintain GSocket running. These malicious processes were renamed in order to appear to be legitimate Linux kernel threads or system services, which made them less noticeable during routine system checks. In some cases, hidden files were also installed in temporary or memory-backed directories to facilitate the deployment process. 

There were some intrusions involving watchdog processes and duplicate copies of the tool, which enabled access to be restored if one instance was removed. Persistence was established by cron jobs, systemd services, and shell startup files. As part of their efforts to complicate investigations, attackers also deleted installation files and other traces of deployment. 

Moreover, the research identified attempts to exploit the Linux kernel vulnerability CVE-2026-43284, commonly referred to as Dirty Frag, which can allow attackers to elevate their privileges from a web-service account to root. This was observed in a limited number of incidents, but success in escalation of privilege was not always observed. 

Shared relay network complicates blocking

GSocket identifies and authenticates its endpoints utilizing a shared secret rather than a fixed IP address. During installation, a secret is generated and made available to the operator in a variety of ways. By using that information, the attacker can connect to the compromised server using a client that is compatible with the Global Socket Relay Network, regardless of the network address of the compromised server changing. 

Consequently, conventional IP-based blocking is less reliable due to the shared relay infrastructure, rather than controlled by a single attacker. Therefore, blocking an attacker's address may not interrupt the connection, which makes conventional IP-based blocking less reliable. Nevertheless, Microsoft stated that monitoring outbound traffic and imposing egress restrictions remain useful methods of identifying or limiting such activity. 

A host-level investigation and remediation is recommended by Microsoft

GSocket activity should be treated as a host compromise, rather than assuming that patching the vulnerable application will resolve the issue. Security teams should locate and eliminate unauthorized GSocket clients, staged files, and persistence mechanisms, as well as check whether suspicious outbound connections have been terminated. It is also recommended that cron entries, systemd units, and shell startup files be reviewed for unauthorized changes. 

Updated applications, plugins, and server components, as well as unused services and unnecessary administrative paths or file upload paths, should be restricted. Furthermore, organizations should limit outbound connections to destinations necessary for normal operations and monitor any unexpected communications that may occur from web server processes. 

The configuration of temporary and memory-backed directories should be modified so that they cannot be executed, thereby reducing the opportunity for attackers to launch hidden payloads. Moreover, Microsoft advised prioritizing Linux kernel security updates, focusing primarily on the CVE-2026-43284, as well as monitoring suspicious web application processes. 

A compromised Linux server cannot be considered secure unless the GSocket client, persistence mechanisms, and all remaining outbound communication are addressed as part of incident response. According to its research, removing the entry point is only one component of incident response. As the GSocket client is increasingly abused, organizations face difficulties identifying legitimate tools repurposed for malicious purposes. 

Linux environments must be secured against internet-facing applications, monitored outbound network traffic, and audited for persistence mechanisms in order to detect hidden access and be protected from long-term compromises.
Read more »
Technology
AI Pentesting Alibaba Cloud AntiFox AWS Credentials Technology

AntiFox AI Pentest Tool Linked to AWS Production Secret Theft

 

Cybersecurity researchers have linked the open-source, AI-driven penetration-testing platform AntiFox to real-world intrusions involving AWS credential theft and access to production secrets. According to Arctic Wolf Labs, Alibaba Cloud systems hosting AntiFox interfaces were associated with malicious activity against internet-facing web services and connected AWS environments, showing how autonomous AI security tools can be abused for offensive operations. 

AntiFox is built on ARTEX and uses a planner, worker, and main-agent architecture to carry out penetration-testing engagements. Given an authorized target, it can conduct reconnaissance, discover attack surfaces, exploit weaknesses, capture findings, and generate a report with limited human involvement. The project is publicly available on GitHub and has been forked 251 times and starred 474 times, reflecting growing interest in agentic AI security tooling. 

In one observed attack chain, threat actors compromised an internet-facing Microsoft IIS application. Although the exact initial-access vulnerability remains unknown, they used the IIS worker process, w3wp.exe, to create an ASPX web shell and execute operating-system commands. From there, they searched for web.config files and configuration backups, read application settings and database connection strings, enumerated debug and error-log directories, and copied sensitive configuration and log files into a web-accessible upload directory. 

The attackers also attempted to connect to an internal production database using credentials extracted from application configuration. In separate incidents, they began with valid AWS credentials obtained through means that have not yet been determined. Using legitimate IAM identities and, in some cases, assumed EC2 roles, they authenticated to AWS APIs and enumerated services including IAM, EC2, S3, Lambda, Secrets Manager, KMS, RDS, ECS, EKS, Redshift, Athena, Glue, Systems Manager, API Gateway, CloudWatch, CloudFormation, DynamoDB, and Amazon Bedrock. 

Most authenticated cross-service requests returned “AccessDenied” errors, but some discovery and secret-access operations succeeded. Researchers observed successful GetSecretValue requests against production secrets, as well as S3 discovery and object operations using a valid AWS identity. The activity demonstrates how a small initial foothold can escalate into broad cloud exposure when credentials, configurations, and permissions are not properly secured.

The incident highlights the growing risk posed by agentic AI frameworks, which can automate reconnaissance, exploitation, credential validation, and post-exploitation at machine speed. AntiFox and ARTEX are among roughly 45 open-source agentic attack frameworks that connect large language models to tools capable of acting autonomously. These systems can assemble attack pipelines at runtime—for example, searching GitHub for exposed secrets, downloading scanners, and passing discovered credentials into subsequent stages of an operation.

Organizations should treat exposed configuration files, hardcoded credentials, and overly broad IAM permissions as urgent risks. Security teams should rotate exposed credentials, restrict public access to sensitive files, enforce least-privilege access, and monitor for unusual AWS API activity—particularly bursts of denied requests followed by successful secret retrieval or S3 operations. As AI-driven tools become more accessible, defenders must assume that attackers can automate not only discovery, but also exploitation, credential theft, and lateral movement across cloud environments.
Read more »
Vulnerabilities and Exploits
AI CISO Cyber Patch Fortinet FortiOS vdoms Vulnerabilities and Exploits

Fortinet Releases Fixes for Nearly 100 Vulnerabilities Across Its Product Lineup

 


Fortinet issued 89 security advisories on November 11, covering close to 100 vulnerabilities across its product lineup, with roughly 17 rated critical and nearly 80 classified as high severity. The release stands as one of the company's largest single-day patch drops, touching nearly every major product in its portfolio.

FortiMail received the heaviest concentration of critical fixes. FortiAuthenticator, FortiOS, FortiManager and FortiAnalyzer followed close behind. FortiSASE and FortiClient also received updates resolving critical issues.

The critical vulnerabilities span a wide range of attack classes. Among those fixed are arbitrary code execution flaws, authentication bypass conditions, account takeover paths, unauthorized access to Virtual Domains (VDOMs), server-side request execution, and a command execution bug that could allow an attacker to run commands with super-admin privileges. FortiMail-specific issues include paths that expose secure email accounts and allow IBE webmail session compromise, along with flaws enabling unauthorized webmail password resets.

High-severity fixes address cross-site scripting, code injection, arbitrary file uploads, denial-of-service conditions, man-in-the-middle attack vectors, privilege escalation, and information disclosure. Fortinet has not attributed any of these vulnerabilities to active exploitation in the wild.


A Notable Standalone Finding

One vulnerability drew particular attention from the security research community. Kevin Joensen, a principal security consultant at Baldur Security, identified and named a FortiClient flaw he called "Fortinet2Shell." The root cause is a CORS misconfiguration that allows attacker-controlled web pages to communicate with a local service running on the target machine.

If a victim visits a malicious website while FortiPAM is enabled, an attacker could achieve arbitrary code execution on that system. The flaw is conditional but the bar for triggering it is low: simply visiting a crafted page is enough. Joensen's research illustrates how client-side software that communicates with local services over HTTP remains a consistent attack surface, one that often gets less scrutiny than server-facing products.


AI in the Testing Pipeline

The scale of this release tracks directly to a shift in how Fortinet approaches internal security testing. Carl Windsor, the company's CISO, confirmed that Fortinet has been running frontier AI models alongside its own on-premises models in vulnerability testing for several months.

The program operates in two phases. In the first, models analyzed firmware without access to source code, mapping how products function and identifying potential attack vectors. Those leads were then validated through penetration testing and red teaming. The black-box phase returned few directly exploitable flaws, but the models showed strong capability in comparing firmware versions across releases and building proof-of-concept exploits for bugs that had already been patched.

The second phase involved source code analysis. Across more than 100 tests spanning 30 product families, roughly 40 percent of findings were genuine vulnerabilities, 30 percent were false positives, and the remaining 30 percent were security improvements that did not rise to the level of exploitability.

Windsor did not frame AI-assisted testing as a silver bullet. He acknowledged that the same tools available to Fortinet's internal teams are available to attackers, and he warned that the gap between public disclosure and active exploitation is getting shorter. "The window between disclosure and exploitation continues to shrink, and we expect it to keep shrinking," he said.


The Urgency Behind Early Disclosure

Fortinet's decision to hold technical details until a fixed release is available reflects a deliberate strategy. Once a patch ships, researchers and threat actors alike can reverse-engineer the changes to identify what was fixed and where. For organizations running unpatched versions, that creates a narrow and shrinking window of practical anonymity.

Windsor noted that internet-facing systems should be prioritized for immediate patching. For organizations that cannot apply fixes right away, interim steps include restricting administrative access to trusted IP ranges, keeping FortiManager off public networks, enforcing strong and unique credentials, and requiring multi-factor authentication for all admin accounts. He was direct that none of these measures replace upgrading the software.

Fortinet's PSIRT page at fortiguard.com/psirt carries the full list of advisories and affected version ranges.

The November batch comes weeks after the company released urgent fixes for FortiOS and FortiManager, some of which were also flagged as AI-assisted discoveries. The cadence suggests Fortinet is now committing to more frequent and larger release cycles as a direct consequence of expanding its AI testing program, a move that will likely increase pressure on enterprise security teams to maintain tighter patch windows across Fortinet deployments.


Read more »
Poland
Cyber Attacks ePUAP Government Infrastructure Government Services Platform Poland

Poland Takes Government Services Platform Offline After Detecting Cyberattack


Poland has temporarily shut down its national electronic government services platform, ePUAP, after authorities detected and stopped a cyberattack targeting the system. The precautionary shutdown has disrupted access to several online public services used by citizens, businesses and government institutions.

The incident was confirmed by Polish Digital Affairs Minister Krzysztof Gawkowski, who said security teams had responded immediately after identifying the attack. In a social media statement, Gawkowski said the cyberattack against the state-run ePUAP system had been detected and halted, while technical teams were working to restore its full functionality.

The ePUAP platform is a central part of Poland's digital government infrastructure. It allows individuals and businesses to submit official documents, communicate with government departments and complete various administrative procedures online. Its temporary closure has therefore affected an important channel through which people interact with public authorities.

Gawkowski also confirmed that the infrastructure of the Central Information Technology Center, the government agency responsible for maintaining ePUAP and other essential digital services, remained secure. Officials stressed that the platform was taken offline as a precautionary measure rather than because the cyberattack had caused damage or disrupted its operations.

Marek Gieorgica, spokesperson for Poland's Digital Affairs Ministry, told the Polish news agency PAP that the system had not been compromised by the incident. He explained that authorities had deliberately disabled the platform to reduce potential risks while security teams assessed the situation.

However, the government has not disclosed technical details about the attack, including the methods used by the attackers or the identity of those responsible. There is also no public confirmation that hackers gained unauthorized access to government systems or managed to steal sensitive information.

According to a notice published on the government's website, ePUAP electronic mailboxes are currently unavailable to both citizens and public institutions. The disruption could also temporarily affect Poland's Trusted Profile digital identity service, which enables users to access online government services and electronically sign official documents.

Authorities have not announced a specific timeline for restoring the platform. Services are expected to resume after cybersecurity specialists complete their investigations and necessary technical checks.

The incident comes amid a series of cyberattacks targeting Polish government institutions, critical infrastructure and private organizations in recent months. In October, online invoicing provider Fakturownia reported a data breach that potentially exposed information belonging to its users, customers and business partners.

Earlier, in September, hackers stole data from Qbusoft, a Polish healthcare software provider, following a separate security incident involving medical technology company MyDr. Polish authorities said the MyDr breach could have affected information associated with approximately 19 million individuals and around 12,000 healthcare organizations.

Read more »
infostealer malware surge
AI Models AI Risks AI technology Cyber Security cybercriminals Data protection data stealing Doxing infostealer malware surge

Volta-Autodoxer Malware Uses Artificial Intelligence to Rank Victims and Build Detailed Personal Dossiers

 

Cybersecurity researchers at Cisco Talos have uncovered a new piece of malware known as Volta-Autodoxer (VOLTA) which uses commercial AI models to analyse the data it steals from Windows systems, identifying the most valuable targets. This shows that AI technology is now increasingly being used inside malware to automate processes. 

While traditional infostealers will steal sensitive data from infected systems such as saved passwords, browser cookies, payment card details, crypto wallet recovery phrases, authentication tokens and cloud credentials, the attacker often has to manually search through large amounts of data to identify valuable targets. Volta aims to cut this out using automated analysis of the victims data on the infected system. 

During the data collection phase, the malware will collect credentials, session data, Wi-Fi profiles, SSH keys, Microsoft OAuth tokens and screenshots of the desktop. It will also target Discord, Telegram, Steam and Roblox accounts to collect active session and account data. It will then use the stolen session tokens to access the victims main email accounts. This includes Gmail and Outlook. It will look at purchase confirmations and order history on services like Amazon, UberEats, DoorDash and Grubhub. This can give an insight into the victims home address, shopping habits, daily routines, work details and other personal information. It can also look up third-party services such as Rolimons to determine the resale value of their Roblox items. 

The malware will then organise the data it has collected and send it to OpenRouter, an API gateway that allows access to multiple AI models. The prompt inside the malware will tell the language model to act as a forensic intelligence analyst. It will create a detailed report on the victims and will identify if they could be valuable financially and how good their operational security is. The malware will use Anthropic’s Claude Opus 4.6 model by default. However, the developers have considered that there may be AI safety measures in place preventing the creation of malicious reports. 

The malware will look for rejection phrases such as 'I can’t’ in the models responses and switch to another provider if the request is denied. It will switch to Moonshot AI’s Kimi K2 and Google’s Gemini 2.5 Flash. Once the report has been created, the malware will package the stolen data and AI report into ZIP files. These will be sent directly to the attackers via a Telegram channel. Files will be named things like volta_dox.zip. The malware was discovered by Cisco Talos during their research using the CAIRN research framework. 

The builder also has configurable fields suggesting that this malware may have been designed to be distributed or sold to other cybercriminals. While it has not been seen widely in the wild, it shows how AI can be used to help attackers target victims more effectively by automatically creating profiles. This makes the personal information stolen more useful for targeted cybercrime.
Read more »
Unauthorized AI Usage
AI Security API Key Theft Cloud Security Credential Exposure Cyber Attacks Cybersecurity Incident LLMjacking Railway Data Breach Stolen AI API Keys Unauthorized AI Usage

Stolen Customer AI Keys Lead to $740,000 in Unauthorized Charges at Railway


A cyberattack on Railway, a cloud hosting provider, in October exposed customer credentials that resulted in approximately $740,000 worth of unauthorized artificial intelligence (AI) usage charges. In addition to stealing customer secrets, hackers also acquired credentials to AI service providers, which were used to generate fraudulent usage across several AI platforms with the stolen keys. 

Railway revealed in a report published on November 11 that attackers gained access to decrypted environment variables belonging to a maximum of 1.85% of its workspaces, or approximately 100,000 workspaces. Nevertheless, the company clarified that this represents the potential scope of exposure rather than the number of compromised credentials confirmed by the company. 

A security incident was first reported by the railroad on October 22, and customers were advised to rotate sensitive credentials stored on the railroad's platform. Further investigation revealed that the attackers had also accessed internal source code, build histories, and linked account tokens for 1,852 users as well. In addition to resettling the affected tokens, including GitHub OAuth credentials as well as Bring Your Own Key (BYOK) agent keys, Railway also notified the affected users. 

It has been determined that the attackers searched Railway's production database for environment variables related to artificial intelligence providers. There were also queries targeting credentials connected to cloud services, databases, and payment platforms. Following the theft of the AI keys, external AI services were accessed and unauthorized charges were generated valued at $740,000. The financial impact varies according to the refund policies of the individual AI providers. 

Amazon Bedrock and Google Gemini have begun processing refunds under their existing fraud policies, whereas OpenAI and SpaceXSI are evaluating each claim individually. As of the date Railway published its report, discussions with Anthropic were still ongoing. OpenRouter maintains a no-refund policy, and will not reimburse the affected usage. Railway has pledged to cover breach-related charges that providers do not refund.

In its investigation, Railway reported that it found no evidence that attackers had accessed customer databases or downloaded customer Git repositories. However, Railway customers who rely on it to store sensitive application secrets were exposed to environment variables and linked account credentials, posing a substantial risk. 

Attackers Exploited Multiple Security Weaknesses to Reach Customer Secrets

Upon investigation, Railway determined that there was not a single vulnerability involved in the intrusion, but rather multiple stages. The attack began on October 20, when a threat actor partially bypassed filesystem isolation on a host virtual machine by exploiting an undisclosed flaw in the platform's multi-tenant build system. 

The credential provided was originally designed to allow build servers to push container images on the platform. By using this credential, the attackers were able to gain access to Railway's internal Temporal workflow system, which mistakenly accepted it as a trusted client. These data included cached copies of Railway's internal source code repository, as well as stored histories of 353 builds, including secrets used in those processes. 

Another vulnerability in Railway's cloud deployment infrastructure was identified through analysis of the source code. Following the exploit of a misconfigured OpenID Connect (OIDC) identity binding, the attackers obtained temporary cloud credentials. The credentials enabled access to additional internal resources, including a computer containing the decryption credentials necessary for accessing the environment variables of customers. 

On October 21, 04:07 and 07:15 UTC, the attackers accessed the production database for encrypted variables, prioritizing entries related to artificial intelligence service providers. It has been confirmed by Railway that the credentials were decrypted in two separate periods before the intruders were entirely eliminated at 09:24 UTC on October 21. 

Railway engineers worked simultaneously to contain the intrusion as attackers used AI-powered agents to identify and exploit vulnerabilities during a prolonged security battle, according to the company. The attackers reportedly employed modified artificial intelligence models to assist with their operations that were devoid of safety restrictions. 

The railway industry strengthens its infrastructure following the breach

In invenstigation it was found that fRailway revised parts of its build infrastructure and closed the vulnerabilities involved. As a result, each build runs within its own, independent, short-lived virtual machine, with credentials restricted to pushing a specific image of a container. A logging system has also been implemented for every encryption and decryption operation to provide improved visibility into access to sensitive customer data. 

A rotation of internal credentials, replacement of potentially compromised infrastructure tools, and the implementation of additional controls for revoke application permissions in bulk when suspicious activity is detected by the railroad. The company has also notified the FBI's Internet Crime Complaint Center (IC3) and engaged a digital forensics firm to conduct an additional investigation into the incident. 

The Railway Breach illustrates the growing threat of AI credential theft

A Railway investigation suggests the stolen credentials may have been intended for resale or to be used in AI model distillation. This process involves querying existing AI models at scale and using their response information to train smaller models. Using stolen API keys, attackers can access expensive artificial intelligence services without paying for the usage, whereas legitimate account holders must pay for it. 

As part of a broader series of attacks against artificial intelligence development platforms dubbed "Black October", the incident is part of a wider series. There were initially nine platforms reporting security incidents during October, with the number growing to fifteen later. It has been identified by several investigations that attempts have been made to steal environment variables containing credentials for AI services, although these incidents have not been linked to any vulnerabilities or software components. Moreover, stolen AI credentials are increasingly used to facilitate LLMjacking, a form of cybercrime in which hackers hijack access to large language models by stealing API keys or cloud credentials. 

It is possible to resell the stolen access to third-party services or to use it for large-scale AI workloads, shifting infrastructure costs onto legitimate users. The Railway Incident demonstrates the importance of ensuring machine identities and stored secrets are adequately protected. Experts in security recommend rotating credentials, restricting API permissions, setting strict usage limits, and monitoring unusual AI use. A compromised cloud infrastructure can also result in significant damage due to the use of short-lived credentials, limited access privileges, and continuous monitoring of decryption activity.

A security breach involving API credentials, which can result in significant losses for a company and broader cloud security concerns, highlights the growing security risks associated with AI development platforms. In order to limit the impact of compromised API keys, organizations need to strengthen credential management, enforce least privilege access, and monitor unusual API activity.
Read more »
Russian Hackers
cerealbox Email Safety ESET EU malware NATO Romania Russian Hackers

Russian Hackers Exploit Government Email Infrastructure in Romania and Kazakhstan

 



Russian cyberespionage group Turla has deployed a previously undocumented malware framework against government organizations in Romania and Kazakhstan, exploiting Microsoft Exchange infrastructure to monitor communications and selectively collect email messages. The operation involved a collection of interconnected .NET-based tools that allow attackers to execute commands, examine organizational networks and maintain access without relying on conventional external command-and-control infrastructure.

Slovak cybersecurity company ESET identified the framework, named Cereal, during an investigation that began on November 28, 2025, when researchers discovered suspicious components on a Kazakh government Exchange server. Further analysis and improved detection capabilities led to the identification of another deployment at a Romanian government organization, which had been compromised on December 23, 2025.

The Romanian intrusion attracted particular attention because the attackers had configured the malware to identify correspondence involving NATO and European Union institutional email addresses. This targeting coincided with escalating tensions between Russia and NATO, including repeated incidents involving Russian drones entering or crashing near Romanian territory.

The Kazakhstan incident presents a different intelligence context. Researchers noted that the compromise occurred amid increasing pressure on Russian exiles and Kremlin critics residing in the country. Access to government communications could potentially provide intelligence about individuals known to local authorities. However, ESET could not establish whether gathering information about dissidents was the actual objective.


Cereal Exploits Exchange's Internal Architecture

Unlike conventional email-stealing malware that operates as an independent application, Cereal integrates its collection capabilities into Microsoft's existing email-processing environment. Its CerealBox component operates inside EdgeTransport.exe, the Exchange service responsible for handling incoming and outgoing messages.

The component uses an unconventional method to intercept email processing. Rather than installing itself as a separately registered Exchange transport agent, it modifies the handlers of existing agents while operating in memory. This allows its malicious instructions to execute alongside legitimate email-processing functions without introducing an additional agent into the server's configuration.

CerealBox examines messages against predefined collection conditions involving sender and recipient addresses, subject lines and attachment names. Messages containing Word documents or PDF files can also qualify for collection when they match the configured filters. Selected communications are compressed, encrypted and temporarily stored for subsequent retrieval by the attackers.

The original email delivery process continues operating, meaning users may not experience an obvious interruption even while selected correspondence is being copied.


Compromised Servers Replace External Command Infrastructure

Another unusual feature concerns how Turla operators communicate with the malware. ESET did not identify dedicated external command-and-control servers in the investigated deployments. Instead, the attackers used the compromised Exchange infrastructure itself to receive instructions and coordinate malicious activity.

CerealNeuron facilitates this arrangement by operating as a passive backdoor. It monitors incoming web requests through paths associated with legitimate Exchange services, including Outlook Web Access, Autodiscover and ActiveSync. Requests containing properly encrypted instructions can be processed as commands, while invalid requests are redirected to legitimate-looking Exchange error pages.

CerealHermit provides an alternative execution mechanism by retrieving encrypted instructions from local files rather than accepting network requests. Both components can provide operators with access to compromised environments.

The framework also includes CerealLoader, CerealRunner, CerealSprinter, CerealIron and CerealMoth, which support payload loading, execution, process injection and the execution of individual .NET assemblies. These components allow attackers to perform activities such as querying Active Directory, retrieving mailbox contents, examining running processes, collecting stored credentials and accessing files.

ESET also documented the abuse of lesser-known .NET execution mechanisms, including native entry points, VTable Fixups and the framework's precompiled assembly cache. These techniques help malicious code execute through legitimate Windows and Exchange processes while reducing the visibility of its actual functionality.


Romanian Authorities Confirm Disruption

Romania's Intelligence Service (SRI) confirmed on November 11 that its National Cyberint Center had identified the intrusion in December 2025 and implemented countermeasures to contain it.

According to the agency, attackers exploited systemic vulnerabilities in Microsoft operating systems. The intervention stopped the operation and enabled the restoration of the affected email service. SRI stated that investigators found no evidence of sensitive data exfiltration and confirmed that relevant European intelligence partners, including counterparts at the EU and NATO, had been informed.

ESET attributed Cereal to Turla with high confidence, citing the presence of another component previously associated with the group and similarities between the toolkit's design and older Turla malware.

Also tracked as Snake, Secret Blizzard and Venomous Bear, Turla has conducted espionage operations since at least 2004. The group is widely assessed to be associated with Russia's Federal Security Service (FSB) and has historically targeted government institutions, diplomatic missions and defense organizations across Europe, Central Asia and the Middle East.

ESET's telemetry indicates that approximately 70% of the countries targeted by Turla since 2022 were former Soviet republics or European countries historically aligned with the Soviet Union.

Read more »
Technology
Anthropic AI Bug Hunter Mythos 5.2 Technology

Mythos 5.2: Anthropic’s AI Gets Better at Finding Vulnerabilities

 

Anthropic has released Claude Mythos 5.2, an access-restricted AI model designed for advanced cybersecurity work, alongside the broadly available Claude Fable 5.2. The company says the new model finds more software vulnerabilities than its predecessor while attempting to escape test sandboxes far less often, signaling progress in both offensive-capability testing and containment controls. 

Mythos 5.2 and Fable 5.2 share the same underlying model, but differ in safety guardrails: Fable includes protections against cybersecurity and biology misuse, whereas Mythos omits some of those restrictions and is available only to vetted organizations through Anthropic’s Cyber and Life Sciences Verification Programs. Anthropic positions Mythos 5.2 as its most capable model for cybersecurity engineering, with stronger abilities to identify, reproduce, and fix vulnerabilities. 

The most prominent external result comes from Mozilla. Brian Grinstead, a distinguished engineer at Mozilla, said that successive Claude models have helped harden Firefox throughout the year, leaving fewer and subtler defects to uncover. Even so, Mythos 5.2 roughly doubled the vulnerability-discovery metrics of Mythos 5.1 across Mozilla’s respective scanning campaigns. 

Measuring the gains 

Anthropic’s internal benchmark, CVE Rediscovery, gives a model source code from before a known CVE was patched and asks it to locate the flaw without assistance. In an October evaluation involving 1,829 CVEs, Mythos 5.2 achieved an 89.6 percent success rate, compared with 78.3 percent for Mythos 5.1 and 81.3 percent for Opus 5.5 when tested without safeguards. 

Anthropic also cited outside testers, including one security company that found that one in six confirmed bugs identified by Mythos 5.2 had been missed by every other frontier model it tested. However, the company added an important qualification: on its own evaluations, vulnerability identification was roughly on par with Opus 5.5, a reminder that benchmark results can vary depending on the test design and evaluation conditions. 

The release also addresses a major safety concern: whether a powerful AI model can circumvent the environment meant to constrain it. Anthropic tested more than 1,800 scenarios in which the sandbox contained an intentional flaw and most tasks could be completed only by escaping it. Mythos 5.2 used credentials or files placed outside the sandbox in 3.1 percent of scenarios. 

That result represents a substantial improvement over earlier versions. Mythos 5.1 escaped or relied on external resources in 21 percent of scenarios, while Mythos 5 did so in 39 percent. Mythos 5.2’s rate was also close to Opus 5.5’s 3.3 percent, suggesting that Anthropic has narrowed a gap in containment behavior between its specialized cyber model and its general-purpose flagship. 

Access and safeguards 

For organizations that do not qualify for direct Mythos access, Anthropic is offering an indirect route through Claude Security, its code-vulnerability scanner, which now uses Mythos 5.2 among other models. This allows enterprise customers to benefit from the model’s bug-finding capabilities without receiving unrestricted access to the underlying system. 

Fable 5.2, by contrast, is available to general users and includes classifiers that block penetration testing, exploit generation, and other high-risk cyber tasks. When such a request is blocked, users receive a response from Opus 4.8 instead. Anthropic says the safeguards remain as robust as those in Fable 5.1 but trigger less often during legitimate work, with early testing showing roughly 60 percent fewer cybersecurity blocks. 

The release illustrates the growing tension at the center of AI cybersecurity: models are becoming more effective at finding real vulnerabilities, which can help defenders patch software faster, but the same capabilities could be valuable to attackers if access controls or safeguards fail. Anthropic’s approach is to separate a highly capable model from its most sensitive uses, reserve direct access for vetted organizations, and route public users toward a more restricted product.
Read more »
Subscribe to: Posts (Atom)