Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Vulnerabilities and Exploits. Show all posts
Vulnerabilities and Exploits
Arbitrary code execution Commerce Cloud SAP Flaw Vulnerabilities and Exploits

SAP Commerce Cloud Vulnerability Targeted After Patch

 

A maximum-severity vulnerability in SAP Commerce Cloud is reportedly facing exploitation attempts only days after SAP released a security update. Tracked as CVE-2026-58231, the flaw carries a CVSS score of 10.0 and affects the platform’s Data Hub Adapter component. Its rapid targeting highlights the risks organizations face when internet-facing enterprise software remains unpatched. 

The vulnerability stems from insufficient authorization checks and inadequate input validation. According to the vulnerability description, an unauthenticated attacker can abuse a default authentication client and submit specially crafted input to functions that do not properly validate requests. Successful exploitation could allow arbitrary code execution and enable attackers to compromise internal components, potentially affecting the confidentiality, integrity, and availability of affected Commerce Cloud environments. 

Threat intelligence company Defused Cyber reportedly observed exploitation attempts against its honeypot systems approximately three days after the patch was released. However, the company stated that the activity did not include a publicly available proof-of-concept and that confirmed exploitation in customer environments had not been established at the time of reporting. Even so, the short gap between patch availability and attack activity demonstrates how quickly threat actors can reverse-engineer or operationalize information about critical enterprise vulnerabilities. 

SAP security specialists have urged customers to treat the issue as an emergency. Organizations using the affected Commerce Cloud release should apply the fixed version identified in SAP’s security guidance, rebuild the updated application, and redeploy it. Simply installing a component update may not be sufficient if the deployment process requires rebuilding and publishing a refreshed Commerce Cloud version. Administrators should also review logs, authentication activity, unusual requests, and unexpected changes to internal services for possible indicators of compromise. 

If immediate patching is not possible, organizations can temporarily reduce exposure by configuring an IP Filter Set to restrict access to the vulnerable endpoint. Network controls should be considered only as a short-term mitigation, not a replacement for the official update. Security teams should identify all internet-facing SAP Commerce Cloud instances, confirm their versions, limit unnecessary access, and increase monitoring around the Data Hub Adapter. Previous attacks against critical SAP products, including NetWeaver, show that criminal and espionage groups have targeted SAP flaws for code execution, persistence, and data theft.
Read more »
Vulnerability Discovery
Agentic Security AI Security AI Vulnerability Testing Claude Mythos Payment Network Security Visa Cybersecurity Vulnerabilities and Exploits Vulnerability Discovery

Visa Deploys Mythos to Uncover Vulnerabilities in Its Payment Network

During Anthropic’s Project Glasswing initiative, Visa evaluated Claude Mythos Preview against its global payment processing network. Operating across 200 countries and processing transactions across 160 currencies, Visa’s network connects 5 billion payment identifiers with more than 175 million merchant locations. 

Initial findings across participating critical infrastructure entities surfaced over 10,000 high- or critical-severity vulnerabilities within the initiative's first month. Beyond simple static scans, static flaw detection, the Mythos framework demonstrated the capacity to connect separate, minor flaws into across distinct network sectors into complex, composite attack chains. 

In response, Visa’s zero-trust architecture, network segmentation, and defense-in-depth controls successfully contained these hidden attack paths" or "potential entry points , keeping attackers from reaching them from the outside. After the Glasswing evaluation, Visa open-sourced its internal framework, the Visa Vulnerability Agentic Harness (VVAH). This system is meant to connect automated checks with reviews. 

VVAH has an 11-step process divided into four parts.

Contextual Threat Modeling
Using wide-ranging scans VVAH uses STRIDE/OWASP methods, in Phase 1 (Discovery & Modeling) to map the active attack surface before scanning. 

Noise Reduction & Consensus

Results are checked using paths where agents vote, which helps filter out false positives before alerting security teams. 

Model Agnosticism & Remediation Limits

Built on a vendor-neutral architecture VVAH works with Anthropic Claude and OpenAI-compatible tools during the checking steps. However full automatic code changes (Stage 10) and testing against attacks (Stage 11) still need models that can edit files directly. 

Visa’s adoption of these agentic security tools is part of a larger trend in enterprise measurement evolving past Mean Time to Detect (MTTD) and towards Mean Time to Adapt (MTTA), or how quickly an enterprise can validate, patch, and verify an exposure in their systems. To secure its software supply chain, Visa has required continuous software composition analysis and SBOM validation throughout their vendors. Visa is also involved with Project Lightwell, a collaboration between IBM, Red Hat, and Visa to help secure open-source components through AI-powered validation and patching processes. 

Visa ran Mythos against itself to prove that as offensive technologies become more automated in their reasoning, defensive systems need to be just as quick and sophisticated. “We open sourced VVAH to provide the community with a governed reference implementation and shift cybersecurity, so teams can patch flaws as fast as automated tools find them,” said Visa.
Read more »
Zero Day
CVE GeoServer RCE Vulnerabilities and Exploits Zero Day

GeoServer Zero Day Being Probed While No Patch Available


A newly found GeoServer zero-day is already receiving active exploitation efforts, while there is no patch ready yet. Firms using the open-source geospatial platform should keep an eye out for their exposure. 

A cybersecurity expert with the handle q1uf3ng found the vulnerability which has not been given any CVE identifier yet.

Zero-day with no patch

The vulnerability exists in the jsonArrayContains functionality and permits illegal SQL injection. In few configurations, particularly where the flaw can reach a privileged database account, that path may result in remote code execution. The vulnerability has not been given any CVE identifier yet. 

The flaw was publicly revealed on 12 August 2026. Soon after, watchTowr said it started noticing exploitation attempts, with hundreds of attempts coming from a few IP addresses. According to WatchTowr’s Jake Knott, “Within hours of public disclosure, we began observing exploitation attempts and have since recorded hundreds of attempts originating from a small number of source IP addresses. Yet another example of how quickly attackers move once a vulnerability enters the public domain.”

The timing is crucial here. When enough technical information or proof of concept is public, threat actors don’t have to wait for a well planned exploit. They can compare responses, scan broadly, trigger errors, and make a list of devices to visit later. It is spying with an error message as a compass.

Cyber criminals are probing the flawed GeoServer systems, but no confirmed exploit has been found yet. But experts have warned that exploitation could soon happen. 

According to Knott, “However, this is unlikely to remain the case for long: GeoServer has a track record of being targeted and exploited at scale, with multiple vulnerabilities listed in CISA’s Known Exploited Vulnerabilities catalog. With no patch currently available and exploitation already underway, organizations running GeoServer should take this vulnerability seriously and, where possible, identify exposed instances, restrict public access, and monitor for a vendor fix.”

Threat actors are triggering errors to find vulnerable targets before active exploitation, and probing GeoServer systems for unpatched zero-day.

About GeoServer

A well-liked framework for exchanging and publishing geographic data via web services is called GeoServer. Public sector portals, environmental platforms, mapping initiatives, utilities, transportation systems, academic institutions, and internal corporate applications are some of the places where it can be found. Because of this, a remotely reachable instance becomes more than just a technical detail; it may provide credentials, backend services, geographic data, or a path to a larger network.

Read more »
Vulnerability Validation
AI cybersecurity AI Vulnerability Detection Cybersecurity Testing Exploit Validation Penetration Testing Software Vulnerabilities Vulnerabilities and Exploits Vulnerability Validation

AI-Assisted Bug Discovery Still Depends on Human Validation

With artificial intelligence, security researchers can identify software vulnerabilities much faster by scanning code, generating payloads, mapping attack surfaces, and automating repetitive testing. However, finding a potential flaw is only the beginning. It takes human expertise to prove that a vulnerability is valid, exploitable, and relevant. This distinction is becoming increasingly crucial as artificial intelligence-generated security findings become increasingly prevalent. 

Research still requires identification of whether an attacker is able to reach the affected code, whether authentication or authorization controls intervene, and whether the issue produces a meaningful security impact, not just a polished report, severity score, or seemingly convincing proof-of-concept. In addition to reproducing a technical flaw, human validation involves more than reproducing it. 

During analysis, analysts must determine whether the attack could actually be weaponized under realistic circumstances, including the possibility of increasing privileges, moving across systems, gaining access to sensitive data, or combining several weaknesses together to create a viable attack path. The assessment provides evidence for security teams to respond to an AI-generated possibility. 

There has already been a noticeable increase in low-quality AI-generated submissions in bug bounty programs. Although such reports may look professional, they may provide limited evidence, creating additional work for security teams rather than delivering useful security intelligence. Artificial intelligence can identify patterns that mimic vulnerabilities such as SQL injection, SSRF, and remote code execution. Despite this, suspicious code does not automatically represent a vulnerability that can be exploited. 

Testers must ensure reachability, comprehend the configuration of the application, and determine whether security boundaries have in fact been crossed. In order to differentiate genuine vulnerabilities from false positives, experienced researchers must have a thorough understanding of application behavior, protocols, authentication, memory corruption, business logic, and identity systems. 

To put technical findings into the context of business, human judgment is also required. It is important to note that the severity of a vulnerability is not solely determined by the vulnerability but also by the systems affected, the privileges required, operational dependencies, and potential consequences to the organization. 

Analysts can translate these technical details into meaningful enterprise risks and can assist in determining which issues require immediate attention. Moreover, it enables them to recognize when several seemingly minor problems may combine into a more serious attack scenario. According to experts, excessive reliance on artificial intelligence may lead to the weakening of these skills in the future. 

In spite of the fact that AI can accelerate testing and reduce repetitive tasks, if it is allowed to handle too much reasoning, practitioners may be less prepared to analyze unfamiliar systems or troubleshoot when automated approaches fail. Additionally, AI has limitations when attacks do not follow the path that was expected. 

A real adversary changes tactics when faced with authentication barriers, detection controls, or unexpected behavior of the system. Testers can reassess the situation, pivot to a new attack path, and combine weaknesses in ways that a computer model may not be able to capture. Security testing must continue to be realistic by maintaining an element of adaptability. 

In contrast to confirmed findings, AI-generated results are better treated as leads. It is essential that researchers are able to reproduce the behavior, identify the input or state that was controlled by the attacker, demonstrate the affected security boundary, and demonstrate the actual impact of the vulnerability before they report a vulnerability. 

Human review can also reveal gaps in AI-based coverage. It is especially efficient for automated systems to identify patterns across large volumes of data; however, they may overlook techniques that are low-frequency, emerging, involve complex identity abuse, or cross multiple trust boundaries. Testers can challenge those assumptions and intentionally examine paths outside of the model's logical assumptions. 

The value of human validation does not end with vulnerability triage alone. The documentation of exploit evidence can assist organizations in demonstrating the effectiveness of security controls in realistic attacks. If a vulnerability has been reproduced, the detection and response mechanisms have been tested, and the risk has been demonstrated, then evidence of this can serve as a more useful tool than an automated alert. 

AI will continue to gain in capability as it becomes increasingly useful for offensive security. In any case, the fundamental standard remains unchanged: a vulnerability must be demonstrated rather than simply suggested. The most effective security teams will use artificial intelligence to accelerate investigation while keeping human judgment as the final assessment of whether a finding meets the criteria for being taken action upon.
Read more »
Webmail Security
AI Email Attacks Authentication Tokens CSS Attacks CSS Vulnerabilities email security Password Theft Vulnerabilities and Exploits Webmail Security

New CSS Attacks Expose Webmail Users to Passord and Token Theft


In new research, CSS-based attacks have been discovered that can bypass security protections in webmail services, allowing attackers to steal passwords, authentication tokens, and other sensitive data. In order to demonstrate the ability of malicious email content to interact with trusted elements within a webmail interface, these techniques demonstrate how their contents can escape their intended boundaries. 

Gareth Heyes, PortSwigger researcher, presented the study at Black Hat USA 2026. The research examined attack chains with Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail. There has been no report of proof-of-concept attacks being used in the wild, however researchers have warned that vulnerabilities in the way webmail platforms handle HTML and CSS may pose serious security risks. 

In one of the most significant demonstrations, researchers were able to disguise a select element as a password field by combining HTML elements, CSS manipulation, and browser behavior. Through the use of this technique, a victim could enter a password into what appeared to be a genuine Microsoft login interface and be captured as a result. 

An underlying problem stems from the fact that webmail platforms allow untrusted HTML and CSS to be displayed within an otherwise trusted interface. It was discovered that attackers could either take advantage of CSS features already allowed by webmail services or exploit the gap between what the sanitizer approves and what the browser actually renders by exploiting the sanitizer. There are also instances in which applications can utilize JavaScript to create new DOM elements with CSS properties that weren't included in the original allowlist of the sanitizer, resulting in the malicious email content escaping its intended boundaries.

Researchers discovered that Yahoo Mail and AOL Mail were vulnerable to a different vulnerability involving pasted HTML Researchers showed how CSS remains active for a short period of time before sanitization allows the attacker to extract portions of an email login token. A 12-character token can then be reconstructed and used to access the victim's account. A CSS selector can be used to determine which digits appear in an email when Content Security Policy prevents an email from making conventional external requests. 

Using CSS selectors, an attacker can identify which digits appear in an email as well as how frequently they occur. By carefully positioning the links so that only the matching option is visible, the attacker-controlled server will receive the inferred information with only one click, without the need for JavaScript. During the Gmail attack, users were required to ask Cowork to process their affected emails, after which the malicious instructions embedded within the message influenced the way the AI system handled the account information. 

During the demonstration, prompt injection, along with email content, demonstrated how the legitimate access of an AI assistant can be turned into a path to expose sensitive tokens, particularly when the assistant has the ability to read messages and write email drafts. A similar attack against the Atlas browser of OpenAI was demonstrated with Fastmail.

In CSS techniques, malicious instructions are concealed from the user while being visible to the artificial intelligence system, demonstrating that differences in how web content is interpreted by human and machine are potentially dangerous, leading to new attack opportunities. Moreover, the researchers identified techniques for manipulating trusted interface actions, bypassing certain content restrictions, and revealing information, such as the time an email was viewed or the IP address of the recipient, in one Proton Mail demonstration. 

Researchers also demonstrated the potential for revealing the recipient's IP address using Proton Mail's tracker-protection mechanisms. As a result of Proton Mail's tracker-protection mechanism, email senders are not able to obtain the IP address of a user and the precise time of email open, the demonstrated bypass illustrates yet again the vulnerability of CSS and webmail rendering behavior to undermine privacy. 

Fastmail was reported to have fixed two CSS mutation vulnerabilities at the time of publication, while the Proton Mail proxy bypass demonstrated at the time was not observed during retesting. However, the Outlook label-jacking technique and Gmail's image-set() bypass remain effective as of August 6. Additionally, the research did not establish whether all aspects of the Outlook password capture chain had been resolved. 

According to the researchers, HTML email should be contained within sandboxed iframes, strict CSS allowlists should be applied, dangerous selectors and select menus should be blocked, custom attributes should be examined for CSS-based attack gadgets and attacker-controlled image requests should be prevented. As traditional content-sanitization defenses face increasingly sophisticated CSS-based attacks, webmail security is becoming increasingly complex. 

With the advent of artificial intelligence assistants having access to email inboxes and other connected services, providers should strengthen their isolation and rendering controls in order to prevent malicious email content from becoming an avenue for credential theft as well as data exposure.


Read more »
Vulnerabilities and Exploits
CVE Cybersecurity Linux red hat Vulnerabilities and Exploits

New 'Zapscape' Linux KVM Vulnerability Opens Path for Privileged Guest-to-Host Escape

 



A newly disclosed vulnerability in Linux's Kernel-based Virtual Machine (KVM) could allow an attacker with kernel-level control inside a nested virtual machine to break out of virtualization boundaries and execute code on the underlying host system under specific conditions.

Tracked as CVE-2026-64561 and dubbed Zapscape, the flaw affects KVM's x86 shadow memory management unit (MMU), a core component responsible for maintaining shadow page tables that translate memory between guest virtual machines and the host. Security researcher Hyunwoo Kim, who identified and disclosed the issue, demonstrated that the vulnerability can be leveraged to execute commands on the host with root privileges.

The issue has been addressed upstream, and administrators operating KVM environments that expose nested virtualization to untrusted virtual machines are advised to deploy patched kernel releases or vendor packages containing the backported fix.

Unlike conventional virtualization deployments where guest systems operate in isolation from the host, nested virtualization allows a virtual machine to function as a hypervisor itself. In this configuration, an L1 guest can create and manage additional virtual machines, commonly referred to as L2 guests. While this capability is widely used for cloud infrastructure testing, development environments, virtualization research, and continuous integration workloads, it also introduces additional complexity into memory management, making implementation flaws particularly impactful.

Zapscape requires an attacker to already possess kernel-level privileges inside an L1 guest, which generally translates to root access within that virtual machine. On Intel-based systems, exploitation additionally depends on exposing both Extended Page Table (EPT) page-walk lengths four and five to the L1 guest. AMD platforms do not impose this additional requirement.

At the heart of the vulnerability is a flaw in the ordering of stale-root validation within KVM's shadow MMU bookkeeping. The weakness results in a use-after-free condition, a class of memory safety bug in which software continues interacting with memory after it has already been released.

According to Kim's technical analysis, the issue occurs while KVM is servicing guest-triggered page faults. During this process, KVM may reclaim shadow MMU pages to free memory resources. That reclamation can invalidate the shadow MMU root page currently being used by the ongoing page-fault handling routine. However, because the fault-handling path fails to verify that the root remains valid after the reclamation step, execution continues using an object that has already become stale.

The researcher explained that the vulnerability originates within KVM's recursive "zap" path, which is responsible for reclaiming shadow MMU pages. Before additional MMU pages are made available, KVM performs an initial stale-root validation. The problem arises because the subsequent reclamation process can invalidate that same root after the check has already completed. Rather than restarting with a fresh and valid root, KVM proceeds to construct new child shadow pages beneath the invalid parent.

Those newly created child pages inherit the parent's invalid state while simultaneously being inserted into KVM's active MMU page list. During later cleanup operations, the same list entry can become attached to multiple linked lists simultaneously. Eventually, the affected page may be freed even though stale references continue pointing to it, leaving behind a dangling pointer and enabling writes to memory that should no longer be accessible.

Such memory corruption primitives can provide the foundation for privilege escalation and virtualization escape techniques, particularly when an attacker already controls a privileged guest operating system.

To demonstrate the vulnerability, Kim released a public proof-of-concept that exploits the bug to create a root-owned file named /Zapscape on the vulnerable Linux host, illustrating successful code execution beyond the guest boundary.

The proof-of-concept was developed against AMD nested virtualization using Secure Virtual Machine (SVM) and Nested Page Tables (NPT) on Linux 7.1.3. For safe experimentation, Kim recommends running the demonstration under QEMU's Tiny Code Generator (TCG) mode. However, the researcher emphasized that QEMU itself is not affected by the vulnerability. Instead, the flaw resides entirely within the Linux kernel's KVM implementation and can be triggered independently of QEMU's device emulation.

Although exploit code is publicly available, Kim cautioned that the demonstration should not be interpreted as an immediately deployable attack against production cloud infrastructure. In its current form, the proof-of-concept requires additional engineering before it could be adapted for real-world environments. Among other changes, portions of the L1 guest activity would need to be moved into a guest kernel module, while the exploit would also require customization for the target host's kernel configuration and memory management backend.

At the time of disclosure, no evidence had emerged indicating that CVE-2026-64561 had been exploited in active attacks.

The National Vulnerability Database lists Linux kernel versions beginning with 5.9 as affected until fixed stable releases became available, including versions 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5.

Security advisories note that administrators should not rely solely on upstream version numbers when assessing exposure. Many enterprise Linux distributions routinely backport security fixes into existing kernel packages without rebasing to newer upstream releases, making vendor advisories the authoritative source for determining whether individual systems have received the necessary patches.

Red Hat assigned the vulnerability a preliminary CVSS score of 7.0 and categorized it under CWE-825: Expired Pointer Dereference, reflecting the use-after-free behavior underlying the flaw.

Package availability also varies across Linux distributions. As of August 6, Debian's security tracker listed kernel packages for bullseye, bookworm, trixie, and forky, including their security repositories, as vulnerable, while sid had already incorporated the fix beginning with version 7.1.6-1.

The coordinated disclosure followed a structured timeline spanning several weeks. Kim privately reported the vulnerability to security@kernel.org on July 11, 2026. A corrective patch was proposed and merged on July 21 before being shared with the linux-distros security mailing list on August 1 under a five-day embargo. The vulnerability subsequently received the identifier CVE-2026-64561 on August 4, with public disclosure taking place on August 6.

The upstream patch, merged as commit 2abd5287f083, modifies KVM's page-fault handling sequence by moving the stale-root validation until after make_mmu_pages_available() completes. If memory reclamation invalidates the current shadow MMU root, KVM now abandons the active page-fault operation and restarts it using RET_PF_RETRY, preventing further memory mappings from being created beneath an invalid root and eliminating the conditions that produced the use-after-free.

Zapscape marks the latest addition to Kim's ongoing security research into Linux virtualization. Earlier this year, the researcher disclosed Januscape (CVE-2026-53359), which affected KVM/x86's shadow MMU, and ITScape (CVE-2026-46316), a separate guest escape vulnerability impacting KVM on Arm64 systems. Together, the disclosures continue to draw attention to the security challenges involved in protecting complex virtualization infrastructure that underpins modern cloud and enterprise computing environments.

Read more »
Vulnerabilities and Exploits
AMD Safe RET vulnerability INTERRUPT INJECTION attack Linux Spectre v2 vulnerability Vulnerabilities and Exploits

Linux Spectre Defenses Can Be Bypassed by Precisely Timed Interrupts, Researchers Find

MIT CSAIL researchers have uncovered a new speculative-execution technique that can potentially undermine Linux protections designed to defend against Spectre v2 attacks. Called INTERRUPT INJECTION, the method allows an unprivileged local attacker to trigger a hardware interrupt during a narrow window between the processor sanitizing its branch predictor and the kernel relying on that protection.

Researchers Daniël Trujillo and Mengjia Yan demonstrated the technique on an AMD Zen 2 processor running Linux 6.14 with the default Spectre v2 mitigations enabled. Their proof-of-concept was able to leak arbitrary kernel memory at a rate of 5.47 bytes per second with 91.97% accuracy. In five out of 10 attempts, the researchers were able to identify and read /etc/shadow, the Linux file containing password hashes.

The attack does not require elevated privileges. It only requires the attacker to execute code locally, making the issue particularly relevant to shared systems where multiple users or workloads operate on the same machine.

The researchers reported the vulnerability to AMD and Intel on February 5. AMD subsequently indicated that a Linux kernel fix was planned, and a corresponding patch has since been incorporated into the kernel and distributed through regular operating-system updates.

The Linux fix is included in the commit titled "x86/bugs: Make Safe-RET robust against interrupt injection", dated June 2. Authored by AMD engineers Borislav Petkov and David Kaplan, the patch specifically addresses the possibility of interrupts interfering with the Safe-RET sequence. The commit warns that interrupt injection "can neutralize the safe return sequence, potentially leading to data leakage through speculative execution."

The fix modifies the processor's register state following an interrupt so that it reflects a completed Safe-RET sequence. It also prevents the system from executing a RET instruction after returning from the interrupt, addressing one of the attack paths outlined by the researchers.

AMD later published security bulletin AMD-SB-7061, titled "Safe RET Interrupt Vulnerability," on August 6. The advisory identifies Zen 1 through Zen 4 processors as affected. AMD says an attacker "could inject an interrupt at a precise moment to disrupt Safe RET," which "could potentially weaken that protection and may result in information disclosure." The company also notes that the vulnerability "appears to be associated with the Linux implementation of the Safe RET mitigation."

According to AMD, the researchers demonstrated the behavior on Zen 1 and Zen 2, while Zen 3 and Zen 4 were identified as potentially affected but were not demonstrated by the researchers. The paper itself describes AMD testing on Zen 2 and Zen 4. However, the advisory's affected-products section does not provide a specific kernel version, patch reference or CVE identifier, potentially making it harder for administrators to determine whether a system has been updated.

The Linux kernel exposes Safe-RET status through /sys/devices/system/cpu/vulnerabilities/spec_rstack_overflow. However, documentation describing the possible values of that file did not reference interrupt-based attacks when The Hacker News reviewed it on August 6.

Intel has taken a different position. In a statement to The Hacker News, Jerry Bryant, Senior Director, Intel Product Assurance and Security, said, "Intel's assessment is that the behavior is related to BHI/IMBTI scenarios which are addressed by Intel's existing Spectre v2 and BHI/IMBTI guidance. Intel has not observed a real-world end-to-end attack on Intel processors and does not plan to add any additional mitigation guidance at this time. Intel's guidance is the same for all supported processor generations."

Arm also responded to the research, stating, "Arm is aware of the TONTOU research paper. While the analysis suggests that some Arm CPUs may exhibit aspects of the behavior described, this behavior would not give an attacker direct deterministic control over the processor’s predicted branch target. Our existing guidance for mitigating Spectre-v2 and Spectre-BHB already addresses the risks identified by this research."

The underlying issue stems from how existing Spectre defenses handle branch predictor state. These protections are designed to prevent attacker-controlled training from influencing speculative execution in kernel code. Intel performs the relevant protections when entering the kernel using eIBRS and, depending on the processor, either a branch history buffer clearing sequence or the BHI_DIS_S control. AMD's Safe-RET mechanism instead operates immediately before returning from the kernel.

The researchers found that these approaches rely on an assumption that no attacker-controlled event can interfere between the predictor state being neutralized and its subsequent use. Their research introduces the term TONTOU, short for "Time-of-Neutralization to Time-of-Use," drawing an analogy with traditional time-of-check-to-time-of-use (TOCTOU) vulnerabilities.

Hardware interrupts challenge that assumption because they can occur at extremely precise points during execution. Linux also allows user-controlled scheduling of certain interrupt-related events with nanosecond-level timing.

On AMD Zen 2, the researchers identified a window spanning just two instructions, or six bytes. To increase the likelihood of hitting that window, they used a sibling hyperthread to evict the relevant instructions from the L1 and L2 caches, slowing their execution. They also targeted the write system call because it allowed them to retain control of two registers.

The researchers observed interrupts landing inside the vulnerable window between 5% and 12% of attempts, with the rate falling to around 2% when the attacker-controlled registers were taken into account.

Once an interrupt occurred at the right point, the interrupt handler could serve as the training mechanism. The researchers combined this behavior with Inception (CVE-2023-20569), an AMD vulnerability disclosed in 2023 that can manipulate the return stack buffer using attacker-selected targets. Safe-RET was itself developed to mitigate threats associated with techniques such as Inception.

The experiments produced speculative mispredictions in kernel code on three of the four processors tested. The researchers recorded success rates of 0.75% on AMD Zen 2, 0.22% on Intel Arrow Lake and 0.037% on Cascade Lake Refresh. No mispredictions were observed during the corresponding test on Zen 4.

An end-to-end information leak was not demonstrated on Intel systems. Such an attack would additionally require a suitable kernel disclosure gadget that could turn speculative execution into observable data leakage.

However, the researchers argue that this does not rule out a practical Intel attack. They told The Hacker News that mispredictions are "a necessary but not sufficient condition for a Spectre attack," and noted that previous research has demonstrated disclosure gadgets in kernels. They added, "we believe an end-to-end attack is possible on Intel as well by combining our Interrupt Injection primitive with this work."

Intel reportedly provided a discretionary bug bounty bonus but, according to the paper, "does not consider mitigation to be required." The company said exploitability "depends on many factors" and that the technique falls within its existing security guidance. However, a review of Intel's INTEL-SA-00598 advisory, whose current version was last updated in May 2025, reportedly found no references to interrupts.

The researchers presented their findings at Black Hat USA. Their paper is also scheduled for presentation at USENIX Security in Baltimore. As of August 6, the artifact repository associated with the research had not yet been made publicly available.

Read more »
zero-day
diplomatic academy hack Korea National Diplomatic Academy South Korea cyberattack Vulnerabilities and Exploits zero-day

South Korea Probes Major Cyberattack on Diplomatic Academy Amid Data Leak Concerns

 

South Korea’s Ministry of Foreign Affairs has revealed that a cyberattack targeting the Korea National Diplomatic Academy (KNDA) may have resulted in the exposure of a significant amount of sensitive data, with authorities investigating the possible involvement of foreign state-backed hackers.

Speaking at a media briefing on Tuesday, ministry spokesperson Park Il said preliminary findings indicate that the breach led to a data leak of “considerable scale.” However, officials are still assessing the full extent of the compromise and have not yet identified the exact type of information that may have been exposed.

Park stated that there is currently no evidence suggesting that any leaked information has been misused. He also noted that investigators do not yet have sufficient technical evidence to determine who carried out the attack, though authorities have not ruled out any possibility, including the involvement of foreign-backed hacking groups.

The update comes after the ministry disclosed on Monday that attackers exploited a previously unknown zero-day software vulnerability along with security configuration weaknesses to infiltrate the online education platform of the Korea National Diplomatic Academy.

According to the ministry, the attackers gained control of a server sometime between April and May 2025 and retained access until February 2026. The breach was discovered after suspicious activity was flagged by a government agency, prompting authorities to block the compromised system.

Officials said the affected platform contained educational content and administrative information required for course management, including participants’ names and user IDs. However, they added that it remains difficult to determine exactly what information was accessed or leaked during the intrusion.

Meanwhile, South Korean newspaper Dong-A Ilbo reported, citing government sources, that personal information belonging to nearly 6,000 current and former diplomats, as well as officials seconded from other ministries, may have been compromised.

The report further stated that intelligence agencies are examining whether a hacking group linked to North Korea could have been responsible for targeting data that includes information related to diplomats posted overseas.

Park reaffirmed that the ministry is coordinating with relevant government agencies to determine the full scope of the breach while also enhancing internal cybersecurity measures to prevent similar incidents in the future.
Read more »
WhatsApp security
Android 16 security flaw Android lock screen bug Gemini vulnerability Google Gemini Vulnerabilities and Exploits WhatsApp security

Google to Patch Gemini Flaw That Lets Locked Android 16 Phones Send SMS and WhatsApp Messages Without PIN

 

Google is preparing to roll out a fix for a newly identified security vulnerability in its Gemini AI assistant that could allow unauthorized users with physical access to a locked Android 16 device to send SMS and WhatsApp messages without entering the device's PIN.

According to reports by The Register, the flaw affects Android 16 smartphones where Gemini is enabled on the lock screen. The issue enables an attacker to bypass authentication and send messages while the device remains locked, posing a potential security risk for users.

The publication stated that it has received several reports since May highlighting the authentication bypass on Android 16 devices with Gemini lock screen access enabled. In May 2026, a security researcher also documented successfully reproducing the vulnerability on a fully updated Pixel 6a using Gemini's Deep Research feature.

Although Google has addressed similar Gemini-related lock screen vulnerabilities in the past, security researchers continue to identify new methods to bypass authentication. This latest issue differs from earlier Gemini lock screen exploits reported since September 2025.

The exploit relies on a specific multi-touch gesture. When Gemini's access to messaging apps has been revoked, attempting to send an SMS from the lock screen normally prompts users to enter their PIN. However, simultaneously pressing the "Continue" prompt and Gemini's "Add attachment" button reportedly allows the message to be sent without authentication.

Researchers also found that an attacker can reconnect previously disabled apps, such as WhatsApp, to Gemini directly from the lock screen. By entering prompts like "@WhatsApp" in Gemini's interface, the app can reportedly regain access without requesting a PIN.

One of the more concerning aspects of the vulnerability is that these permission changes persist even after the device is unlocked later. Users checking Gemini's settings may discover that apps like WhatsApp have been connected despite no authentication having taken place.

The attack requires physical possession of the affected Android device and cannot be executed remotely. However, security experts note that phones are often left unattended, misplaced, or briefly handled by others, creating opportunities for misuse.

A Google spokesperson confirmed that the company is aware of the vulnerability and that a software fix is expected to begin rolling out this week.

"A spokesperson at Google told The Register that this new bug is known about, and that a fix is scheduled to be rolled-out this week."

Until the update becomes widely available, users are advised to limit Gemini's lock screen capabilities. This can be done by opening the Gemini app, tapping the profile picture, navigating to Settings > Gemini on lock screen, and either disabling "Use Gemini without unlocking" or turning off "Make calls and send messages without unlocking."

The incident highlights the growing security challenges associated with AI assistants gaining expanded functionality on locked devices. As AI features become more capable without requiring user authentication, maintaining device security becomes increasingly complex.
Read more »
Zero‑Day RCE
Fastjson JSON U.S. Firms Vulnerabilities and Exploits Zero‑Day RCE

Fastjson Zero‑Day RCE Actively Targeting U.S. Companies

 

Hackers are abusing a critical Fastjson zero‑day remote code execution (RCE) flaw to compromise U.S. organizations by simply sending malicious JSON data to vulnerable Java applications. The attacks center on a vulnerability tracked as CVE‑2026‑16723 in Fastjson 1.x, an open‑source JSON parsing library widely used in Java and Spring Boot applications. 

The flaw affects versions 1.2.68 through 1.2.83 and is exploitable under default configurations, meaning attackers do not need user interaction, elevated privileges, or special deserialization gadgets to gain code execution on target servers. Threat intelligence firm ThreatBook first observed the malicious activity, with Imperva later confirming broad exploitation against firms in financial services, healthcare, computing, retail, and other industries. 

Technically, the issue lies in Fastjson’s type‑resolution logic, which performs attacker‑controlled resource lookups before enforcing AutoType restrictions. Security researchers from FearsOff showed that by abusing @type processing in Spring Boot “fat‑JAR” deployments, they could load and execute attacker‑supplied classes even when AutoType is disabled and without relying on traditional gadget chains. Alibaba’s advisory stresses that the vulnerability is exploitable on the most common Spring Boot executable JAR model launched via java -jar, and that specifying concrete classes for deserialization does not reliably mitigate the bug because payloads can hide inside generic Object or Map fields. 

What makes this zero‑day particularly dangerous is the combination of wide adoption, ease of exploitation, and lack of a direct patch for Fastjson 1.x. Imperva notes that most observed attacks currently hit U.S. organizations, with early signs in Singapore and Canada, and expects the campaign to expand globally as exploit code circulates. Fastjson 1.x is no longer actively maintained, and Alibaba has explicitly signaled that this branch is unlikely to receive a security fix, leaving thousands of applications exposed unless they are re‑engineered. 

Security vendors recommend that organizations immediately inventory applications using Fastjson 1.x and enable SafeMode via the appropriate JVM flag to hard‑block dangerous polymorphic deserialization paths. Longer term, developers are urged to either migrate to Fastjson2—which uses an allowlist‑first model and does not rely on the vulnerable @JSONType semantics—or replace Fastjson with other actively maintained JSON libraries. Until such changes are rolled out, defenders should deploy strict web application firewall rules to filter suspicious JSON payloads, monitor logs for exploitation attempts, and treat exposed services as high‑risk assets that may already be compromised.
Read more »
Zimbra Zero-Day
CVE-2025-66376 cyber espionage email security Laundry Bear Russian Espionage Group Two-Factor Authentication Vulnerabilities and Exploits Zero-Day Exploit Zimbra Security Zimbra Zero-Day

Russian Cyber Spies Exploited Critical Zimbra Flaw to Access Emails and 2FA Codes


 

Cyber espionage groups backed by the Russian government exploited a previously unknown vulnerability in the Zimbra Collaboration Suite (ZCS) in order to steal emails, browser credentials, and two-factor authentication (2FA) recovery codes from government and commercial organizations throughout the world, according to a joint cybersecurity advisory issued by the U.S. National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), and international partners. 

In the campaign, CVE-2025-66376 was used to exploit a stored cross-site scripting (XSS) vulnerability affecting Zimbra's Classic Web Client. According to Proofpoint, the flaw was exploited as a zero-day attack for at least five months before a security patch was available in November 2025, identified by Palo Alto Networks Unit 42 as CL-STA-1114. It is reported by the Dutch General Intelligence and Security Service (AIVD) that the activity is referred to as Laundry Bear, while cybersecurity vendors continue to use different tracking names for the same or similar threats. 

The vulnerability allowed attackers to compromise users by merely opening or previewing a specially crafted HTML email in a Zimbra session that was vulnerable. Upon activating the malicious JavaScript within the authenticated webmail session, attackers gained access to the victim's mailbox without requiring additional interaction from them. 

The campaign has been described as a "half-click" phishing attack by security researchers, as the victim only needed to browse or open the malicious email in Zimbra's Classic Web Client to gain access. As opposed to conventional phishing campaigns that require the user to click links or download attachments, the exploit executed automatically when the email was rendered, which permitted the execution of arbitrary JavaScript within the authenticated webmail session. 

According to researchers, the ZimReaper malware harvested emails from the last 90 days, the organization's Global Address List, browser-stored passwords, details on Zimbra versions and recovery codes for two-factor authentication. Besides exfiltrating data through DNS queries, attackers also created app-specific passwords for retaining persistent access to compromised accounts even after password changes. 

In accordance with the advisory, the campaign targeted government, military, transportation, financial, and scientific organizations throughout NATO member countries, Ukraine, the Commonwealth of Independent States, Africa, and the United States. Researchers did not disclose the number or identities of affected organizations. The operation is believed to have been conducted in support of Russian intelligence objectives to gather sensitive information.

One of the longest-running known exploit campaigns against Zimbra was launched in July 2025, according to intelligence officials. It was publicly disclosed and patched in August 2025, making it one of the longest-running known exploit campaigns. Versions 10.0.18 and 10.1.13 of Zimbra addressed the vulnerability, while CISA added it to its Known Exploited Vulnerabilities (KEV) catalog in March of 2026. 

According to security experts, applying a patch alone will not be sufficient if a system has been compromised since the update occurred. Although Zimbra released a fix in November 2025, the vulnerability was not assigned a CVE identifier until several weeks later and was publicly documented. It has been argued that the delayed disclosure may have contributed to organizations remaining unaware of the active threat while attackers continued to exploit vulnerable servers. 

In addition to upgrading to supported Zimbra releases, organizations are advised to reset passwords for accounts that may be affected, invalidate active sessions, generate 2FA recovery codes, remove unauthorized passwords for applications, and review logs for suspicious activities. Admins should also monitor for unusual DNS requests and inspect email correspondence for indicators associated with the exploit. 

Furthermore, Proofpoint researchers warned that other threat actors have continued exploiting unpatched Zimbra servers, indicating that the vulnerability is still appealing beyond the Russian espionage campaign that originally exploited it. Additionally, the researchers noted that although no evidence has been provided to suggest that the exploit itself was created using artificial intelligence, large language models may assist attackers in identifying future methods for bypassing security patches. 

Despite the absence of activity from the threat group since February 2026, Unit 42 and government agencies remain concerned that attackers continue to target Zimbra environments that are not patched. The advisory warns that Russian espionage actors are likely to continue pursuing email platforms to support intelligence-gathering operations. 

Several zero-day vulnerabilities have been exploited rapidly in this campaign, compromising trusted communication platforms. Organizations using Zimbra are encouraged to ensure that systems are fully patched, review accounts for signs of compromise, revoke unauthorized access, and continuously monitor their environments as a preventative measure against persistent espionage.
Read more »
Vulnerabilities and Exploits
Authentication Bypass CVE-2026-11405 Cybersecurity Firmware Backdoor Network Security Router Vulnerability Tenda Router Vulnerabilities and Exploits

Unpatched Backdoor Identified in Firmware of Multiple Wi-Fi Routers


Research has discovered that several Tenda Wi-Fi routers are at risk of being compromised as a result of an undocumented authentication backdoor embedded in their firmware. An attacker can bypass the normal login process and gain administrator-level access to affected devices through this flaw, and no official security patch has been released yet. 

A US-based cybersecurity authority, CERT/CC (CERT/CC), identified the vulnerability and released it as a security advisory. According to the advisory, the backdoor is present in five firmware versions of older Tenda router models. A CVE-2026-11405 vulnerability has been assigned to this vulnerability. 

It is reported that the vulnerability is associated with the web server's login function, where a failed authentication attempt triggers a secondary verification process for passwords. Instead of validating both the username and password, firmware only checks the password value stored within the device configuration, which enables authentication to be successful regardless of the username used. 

In the case of Tenda devices, access is normally limited to administrator credentials via the web-based management interface. It has been discovered that the firmware contains an undocumented authentication mechanism that is activated upon failure of a standard login attempt. The firmware compares only a password stored in the device configuration, rather than validating both the username and password. Regardless of the username entered, administrative access is granted if the supplied password matches. 

Interestingly, researchers noted that the alternative password appears to be "rzadmin", which has previously been discovered in previous security research involving Tenda devices. However, since the authentication process does not validate the username, any username can successfully login when paired with the appropriate backdoor password. Despite the device's administrative interface, hidden functionality is not documented or disclosed. 

Upon matching the alternate password with the device configuration value, the firmware grants full administrator privileges and creates a valid management session. Because of its undocumented nature and inaccessibility through the standard administrative interface, it has been classified as an authentication backdoor by researchers. 

During previous security research involving Tenda devices, the alternate password was identified as "rzadmin", a credential that has previously surfaced. Despite the lack of clear explanations for its presence, experts believe it may have been accidentally left behind as part of a debugging or development tool. 

One of the biggest concerns is the lack of a vendor response. According to CERT/CC, they were unable to reach Tenda to coordinate a fix, resulting in the non-availability of official firmware updates for affected users. As a result, this vulnerability remains unpatched. Successful exploitation could result in router configuration changes, network settings changes, security settings being disabled, and potentially compromise other local networks. 

A security expert considers this vulnerability to be a significant risk for exposed devices due to its ability to grant administrator-level privileges without standard authentication. This firmware is affecting a variety of Tenda networking products, including routers, wireless hotspots, and other networking equipment. 
The following models have been confirmed as affected: 

  • FH1201 High Power AC1200 Dual-Band Wireless Router 
  • W15E v2.0 AC1200 Wireless Hotspot Router 
  • AC10 v1.0 AC1200 Smart Dual-Band Gigabit Router 
  • AC5 v1.0 AC1200 Smart Dual-Band Router 
  • AC6 v2.0 AC1200 Router 

There is a possibility that some of these products are older models and may already have reached end-of-life, resulting in uncertainty about future security updates. The CERT recommends that, until an official patch is available, remote web management be disabled and the router's default LAN IP address be changed to reduce exposure to automated internet scanning. 

If users have not received firmware updates for their affected devices and are unable to secure them, it may be prudent to replace the router with a supported model. Undocumented functionality embedded in networking firmware poses a number of security risks, particularly when vendors fail to provide timely security updates. 

Since there is no official patch available currently, users are advised to take immediate action to mitigate the vulnerability or to upgrade their hardware in order to reduce the risk of unauthorized access.
Read more »
Windows Update
July 2026 Update KB5099414 KB5101650 Microsoft Patch Tuesday Microsoft Security Patches Vulnerabilities and Exploits Windows 11 Windows 11 Security Update Windows Update

Windows 11 KB5101650 and KB5099414 Updates Released With Security Fixes and New Features


 

A cumulative update for Windows 11 based on Patch Tuesday July 2026 is now available, with KB5101650 for versions 25H2 and 24H2 and KB5099414 for version 23H2. As well as addressing 571 security vulnerabilities, the mandatory updates also improve the usability, accessibility, and performance of the operating system. 

Using the Microsoft Update Catalog or by navigating to Settings > Windows Update and selecting Check for updates, users may download the updates manually, following installation. As a result of the installation, Windows 11 build numbers have been updated to 26200.8875 (25H2), 26100.8875 (24H2), and 22631.7376 (23H). It is noteworthy to note the wider rollout of Point-in-Time Restore, which allows users to restore their systems to a previous state in a more efficient manner. 

Aside from new features, Microsoft has introduced several security-focused improvements as part of the July Patch Tuesday release, as well as enhanced controls for enterprise administrators. As a result of improved device targeting in the update, more eligible systems will be able to receive updated Secure Boot certificates automatically via Windows Update, thus expanding Secure Boot certificate deployment. 

Moreover, Microsoft has also upgraded the built-in curl command-line utility to version 8.21.0, which provides additional security features. In addition to reducing unnecessary notifications and taskbar badges, this update also disables automatic opening on hover, and provides more customization options for Widgets. There are several additional improvements to File Explorer, including quicker launch times, improved responsiveness, enhanced support for complex file paths, and new quick actions such as Open File Location and Ask Copilot for work and school accounts. 

Several additional features have been added to enhance accessibility, including a Screen Tint feature which reduces eye strain and improved Magnifier controls that provide the ability to set precise zoom levels for the Magnifier. 

A number of languages are now supported by Voice Access and Voice Typing, including French, German, and Spanish. These languages now support real-time grammar, punctuation, and recognition enhancements, enhancing dictation accuracy. In addition to improving connectivity and hardware reliability, the release also enhances Bluetooth performance by improving device pairing time, microphone synchronization, voice calls that are more reliable, and LE Audio accessory stability.

With networking enhancements, Wi-Fi crashes are reduced, VPN compatibility is improved, virtualization networks are strengthened, and network settings are preserved during operating system upgrades. The security of Remote Desktop (RDP) has also been enhanced by supporting SHA-2 certificate thumbprints for trusted RDP publishers, while maintaining SHA-1 only for backward compatibility. 

In order to reduce phishing risks and prepare for eventually terminating SHA-1 support, organizations are encouraged to migrate to stronger SHA-256 certificates and update Group Policy settings for Remote Desktop files. Furthermore, the cumulative update resolves a compatibility issue that was caused by the June 2026 security update, which prevented third-party applications using OLE Automation from launching Microsoft Office or opening Office files. 

A further step to strengthen network security was taken by Microsoft by implementing stricter registration requirements for Transport Driver Interfaces (TDI). This may affect applications that rely on unregistered third-party TDI transports. Additionally, improved HD Audio reliability, stability of the Start menu, graphics performance on multiple monitors, Windows Subsystem for Linux (WSL) network improvements, improved printer installation that uses the Internet Printing Protocol (IPP) by default, and enhanced touchpad customization options are also included. 

Microsoft has reported no known issues with this month's Patch Tuesday update, which makes it a relatively stable release in comparison with previous Patch Tuesday releases. Considering the large number of security fixes included, users are encouraged to install the updates immediately to ensure protection against recently disclosed vulnerabilities. Also included in this update is a minor modification to the handling of keyboard shortcuts in Windows by altering how hotkey cleanup is conducted. 

There is a possibility that, in rare cases, certain built-in Windows experiences may temporarily cease to respond to specific keyboard shortcuts after installation. Restarting the affected application should typically resolve the issue, and users may also report persistent problems through the Feedback Hub.

Patch Tuesday updates in July 2026 reinforce Microsoft's ongoing commitment to enhancing the security, stability, and user experience of Windows 11. Hundreds of vulnerabilities have been addressed along with new features and reliability enhancements. Users and organizations are encouraged to install the updates as soon as possible to ensure optimal protection.

Read more »
Vulnerabilities and Exploits
API Bug OAuth RabbitMQ Vulnerabilities and Exploits

RabbitMQ Flaw Exposes OAuth Secrets, Risks Full Broker Takeover

 

A serious vulnerability in RabbitMQ is threatening enterprise messaging systems by allowing attackers to steal OAuth secrets and take full control of brokers. Tracked as CVE-2026-57219, the flaw has a CVSS score of 8.7 and affects popular RabbitMQ versions used across organizations for asynchronous communication and event-driven architectures. 

Discovered by security researchers at Miggo, the vulnerability stems from an obsolete HTTP API endpoint, GET /api/auth, within RabbitMQ's management plugin. When the management plugin is enabled and OAuth 2 is configured using the management.oauth_client_secret setting, the endpoint returns the broker's confidential OAuth client secret to anyone who can reach it, without requiring authentication. Attackers can then exchange this secret for an administrator token, gaining complete control over every message, queue, user, and broker setting in the deployment.

The affected versions span all releases from 3.13.0 onwards, including branches 4.0, 4.1, and 4.2, up to the patched versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6. Enterprises running RabbitMQ in cloud environments, multi-tenant architectures, or setups where the management interface has been inadvertently exposed to the internet face the highest risk. Installations without the management plugin or those not using the specific OAuth client secret configuration are not vulnerable, but many production systems do rely on these features for identity integration and centralized access control. 

In addition to the primary flaw, RabbitMQ also addressed a second, medium-severity vulnerability, CVE-2026-57221, which allows any authenticated user to bypass tenant isolation and read statistics about queues and exchanges across virtual hosts. While this does not permit data modification, it enables attackers with low-level access to perform reconnaissance, map an organization's messaging topology, and plan more targeted follow-up exploits. Both vulnerabilities have existed in the codebase since early 2024, but there is currently no evidence of active exploitation in the wild. 

Mitigation tips 

Organizations using RabbitMQ should prioritize applying the latest patches immediately, as software updates are the only reliable way to close the /api/auth endpoint and fix the authorization bypass. Until patches can be deployed, administrators should restrict network access to the management plugin, block internet exposure, and monitor for suspicious API requests. 

After updating, it is critical to rotate OAuth client secrets, because the vulnerability may have already leaked credentials that remain valid even after the software is fixed. With enterprise messaging at the core of modern application workflows, prompt remediation is essential to prevent potential data breaches and operational disruptions.
Read more »
zero-day vulnerabilities
Microsoft July Patch Tuesday Microsoft Patch Tuesday Microsoft security updates Vulnerabilities and Exploits zero-day vulnerabilities

Microsoft Issues Record 622 Security Fixes in July Patch Tuesday, Urges Immediate Action on Two Exploited Zero-Day Flaws

 

Microsoft has rolled out its largest-ever Patch Tuesday update, addressing 622 vulnerabilities across its software ecosystem. The July release significantly surpasses June's update, which fixed around 200 vulnerabilities, making it the company's most extensive security update to date.

Among the fixes are two zero-day vulnerabilities that Microsoft confirmed are already being actively exploited. The flaws impact on-premises SharePoint Server and Active Directory Federation Services (AD FS), making them the highest-priority patches for organizations.

The first flaw, CVE-2026-56164, affects Microsoft SharePoint Server. According to Microsoft, attackers can exploit the vulnerability remotely to gain elevated privileges without requiring authentication, user interaction, or valid credentials. The company credited Mandiant's incident response team and Google's FLARE team for identifying the issue during active attacks, although it has not disclosed details about the threat actors or attack techniques involved.

Organizations running self-hosted SharePoint servers are advised to deploy the update immediately. Microsoft also noted that enabling Antimalware Scan Interface (AMSI) in Full Mode provides additional protection against exploitation. The timing is particularly significant as SharePoint Server 2016 and 2019 have reached the end of extended support, with no Extended Security Updates (ESU) program available for either version.

The second exploited vulnerability, CVE-2026-56155, impacts Active Directory Federation Services (AD FS). The flaw enables an authenticated attacker to elevate privileges locally due to weak access controls. Microsoft's Detection and Response Team (DART) discovered the issue. While Microsoft has not revealed how attackers are leveraging the flaw or the privileges it grants, AD FS plays a critical role in enterprise authentication by issuing security tokens across trusted environments, making the vulnerability particularly important.

Although neither of the two vulnerabilities has been added to the Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog at the time of writing, Microsoft has already classified both as actively exploited. Security experts recommend organizations prioritize these patches without waiting for a KEV listing.

Microsoft also fixed CVE-2026-50661, a publicly disclosed vulnerability affecting BitLocker. The issue allows attackers with physical access to bypass BitLocker protections. Since the flaw cannot be exploited remotely, it is considered less urgent than the actively exploited zero-days but should still be addressed as part of routine patch management.

Another notable update addresses CVE-2026-55040, a SharePoint JWT authentication bypass vulnerability disclosed by Rapid7 Labs. Researchers demonstrated that the flaw could be chained with a separate remote code execution (RCE) vulnerability to achieve unauthenticated code execution on vulnerable servers. Microsoft has confirmed that the authentication bypass is fixed in July, while the associated RCE vulnerability is scheduled to receive a patch in August.

Kerberos RC4 Hardening Completed

The July release also marks the completion of Microsoft's long-running effort to phase out RC4 encryption within Kerberos authentication. The update removes the rollback mechanism that administrators had been using since January.

After installing the update, RC4 authentication will only function for accounts specifically configured to allow it. Organizations are advised to audit service accounts using Microsoft's RC4 audit events and rotate passwords where necessary so that modern AES encryption keys are generated before deploying the update. Failure to prepare legacy systems could lead to authentication failures after patching.

AI-Driven Security Research Expands Patch Volume

Microsoft previously indicated that customers should expect larger Patch Tuesday releases as artificial intelligence improves vulnerability discovery. In a July 9 announcement, the company said it anticipated a "higher volume of security updates included in each security release" due to AI-assisted security research.

The company highlighted its MDASH multi-model agentic scanning platform, which previously identified multiple vulnerabilities in earlier Patch Tuesday releases. However, Microsoft has not disclosed how many of July's 622 vulnerabilities were discovered using the system.

Faster Patching Becoming Increasingly Important

Security experts warn that the growing number of vulnerabilities makes traditional severity-based prioritization less effective. Once patches become publicly available, attackers can rapidly analyze them to develop exploits, significantly reducing the time organizations have to respond.

Rather than relying solely on CVSS scores, experts recommend prioritizing vulnerabilities based on active exploitation indicators, including Microsoft's exploited status, CISA's Known Exploited Vulnerabilities catalog, and Exploit Prediction Scoring System (EPSS) data.

Microsoft's July Patch Tuesday demonstrates how AI-driven vulnerability discovery is accelerating both defensive and offensive security efforts, making timely patch deployment increasingly critical for organizations.
Read more »
Zimbra vulnerability
CISA CVE-2025-66376 Laundry Bear Void Blizzard Vulnerabilities and Exploits Zimbra Collaboration Suite Zimbra vulnerability

Russian Hacking Group Laundry Bear Exploits Zimbra Flaw to Steal Emails and MFA Data: CISA


 The US Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a Russian state-backed cyber espionage group known as Laundry Bear, also tracked as Void Blizzard, which is targeting organizations running Zimbra Collaboration email servers.

The campaign combines phishing techniques with the exploitation of a Zimbra security vulnerability that has since been patched. CISA said the group has compromised organizations linked to the Defense Industrial Base (DIB), federal and local governments, educational institutions, energy companies, law enforcement agencies, media organizations, non-governmental organizations, and the technology sector.

At the centre of the campaign is CVE-2025-66376, a cross-site scripting (XSS) vulnerability in the Classic UI of Zimbra Collaboration Suite. The flaw could allow malicious JavaScript contained within specially crafted HTML emails to execute when the message was opened. This means attackers could potentially steal sensitive account information without requiring victims to click on a malicious link or access a fraudulent website.

CISA said Laundry Bear used the vulnerability as a zero-day before Zimbra released a patch in November 2025. Despite the availability of a fix, the group continues to target organizations operating vulnerable and unpatched Zimbra servers. CISA subsequently classified the vulnerability as being actively exploited.

The exploitation enables attackers to collect a wide range of information from compromised accounts. According to CISA, this includes a victim's emails from the previous 90 days, email address, password, Global Address List (GAL), and two-factor authentication (2FA) tokens.

The attackers can also generate and send a new Zimbra application passcode. Such passcodes are used by older email clients, including IMAP and ActiveSync, that cannot use TOTP-based authentication. By obtaining an application passcode, attackers can maintain access to compromised accounts even when multi-factor authentication (MFA) is enabled.

Data Exfiltration Through DNS and HTTPS

CISA said Laundry Bear transfers stolen information to infrastructure controlled by the attackers using both DNS and HTTPS. The group relies on its "Flowerbed" collection framework to receive the stolen data.

Smaller pieces of information are encoded and transmitted through DNS A-record queries, while larger datasets, including mailbox contents, are sent over HTTPS. The larger data packages are compressed before being uploaded to attacker-controlled servers.

The campaign is not limited to exploiting Zimbra's vulnerability. Laundry Bear has also deployed adversary-in-the-middle (AiTM) phishing kits that mimic genuine Zimbra login pages. These fraudulent portals are designed to capture users' credentials and session cookies, potentially allowing attackers to take over email accounts.

CISA's indicators of compromise identified several domains designed to resemble legitimate Zimbra-related infrastructure. These include 'mailnalysis.com', 'emailanalytics.com.ua', 'zimbrastat.com', 'zimbra-metadata.com', 'istc-cloud.com', and 'zmailanalytics.com'.

CISA Issues Security Recommendations

Organizations using Zimbra Collaboration Suite have been advised to take several steps to reduce the risk of compromise. CISA recommends:

  • Updating Zimbra Collaboration Suite to the latest available version and applying all security patches.

  • Reviewing CISA's published indicators of compromise.

  • Checking networks and systems for communications with the identified domains and IP addresses.

  • Monitoring accounts for unusual or suspicious authentication activity.

  • Revoking unauthorized application passcodes, particularly those containing the 'ZimbraWeb'.

  • Examining user accounts for signs of unauthorized mailbox access.

  • Deploying phishing-resistant MFA wherever technically possible.

Laundry Bear's Growing Cyber Espionage Activity

Laundry Bear was publicly linked to Russian cyber espionage activity in May 2025, when Dutch intelligence agencies attributed the group to a 2024 intrusion into the Dutch National Police. The incident resulted in the exposure of personal information belonging to police personnel and helped authorities identify a previously unknown Russian espionage operation.

Microsoft tracks the group as Void Blizzard. The threat actor has reportedly been active since at least 2024, focusing on intelligence-gathering operations against organizations considered strategically relevant to Russia. Its activity has largely centred on NATO member countries and Ukraine.

Microsoft has also reported successful intrusions into organizations supporting Ukraine, including those operating in the defense, transportation, and aviation industries.

Laundry Bear has previously used phishing as part of its operations. Earlier in 2026, a separate campaign attributed to the group targeted Ukraine's military with charity-themed phishing messages. The emails reportedly attempted to distribute malware disguised as donation-related requests.

The latest campaign highlights the continued risk posed by unpatched collaboration and email platforms, particularly when attackers combine software vulnerabilities with credential theft and phishing techniques to maintain long-term access to sensitive communications.

Read more »
Subscribe to: Posts (Atom)