Threat briefs

Iranian state-sponsored actors are leveraging the 'Chosen Brick' Windows malware to conduct surveillance on global activists and journalists via social engineering and Telegram-based command-and-control.

An authenticated high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint to execute arbitrary code with root privileges.

An authenticated remote attacker with administrative privileges can execute arbitrary commands with root permissions via a crafted GET request to the /api/iodd/config endpoint.

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files endpoint to achieve arbitrary code execution with root privileges.

A local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint allows a remote attacker with a valid operator cookie to achieve remote code execution.

An improper authorization vulnerability in the /index.php/attached_devices_tab/do_upload endpoint allows low-privileged remote attackers to upload arbitrary files, potentially leading to unauthorized device behavior or denial-of-service.

A low-privileged remote attacker can exploit a command injection vulnerability at the /index.php/ajax/parameterManage endpoint using valid credentials to gain root-level code execution.

CVE-2026-27550 is a command injection vulnerability allowing low-privileged attackers with operator credentials to execute arbitrary commands with root privileges.

The Contest Gallery WordPress plugin is vulnerable to unauthenticated arbitrary file overwrite via the 'baseUrlForFacebook' parameter, allowing authenticated attackers to achieve remote code execution.

The WP-Lister Lite for eBay plugin for WordPress contains a Stored Cross-Site Scripting vulnerability in its AJAX Cron Handler allowing unauthenticated script injection.

The TrueBooker Appointment Booking and Scheduler System plugin for WordPress contains an authorization bypass vulnerability allowing unauthenticated attackers to modify arbitrary user email addresses and facilitate account takeover.

The execution of rundll32.exe without command-line arguments is detected via endpoint telemetry, a behavior indicative of potential malicious activity such as Cobalt Strike, leading to arbitrary code execution and system compromise.

Tornado versions prior to 6.4.1 are vulnerable to HTTP request smuggling via the improper processing of duplicate 'Transfer-Encoding: chunked' headers when deployed behind a proxy.

The http4s Ember HTTP/1.1 parser fails to reject messages containing both 'Transfer-Encoding' and 'Content-Length' headers, enabling CL.TE request smuggling attacks.

An improper eviction logic in the http4s DigestAuth middleware allows unauthenticated remote attackers to cause heap exhaustion and service failure by triggering unbounded growth of the internal nonce map.

A malicious peer can trigger an application crash in libp2p-quic (< 0.13.1) by initiating a QUIC handshake and delaying the final TLS fragment until the peer certificate expires, causing an unhandled panic.

An unauthenticated remote denial-of-service vulnerability in the emp3r0r C2 server (CVE-2026-61554) allows attackers to exhaust server resources by injecting arbitrary request bodies before session authentication.

Multiple vulnerabilities in the @zereight/mcp-gitlab package allow attackers to bypass read-only mode, exfiltrate data, perform unauthorized GitLab operations, and trigger a denial-of-service via unauthenticated session exhaustion.

Roundup of Oracle security advisories published in September 2026.

Flowise versions before 3.1.4 contain authorization gaps in Enterprise endpoints that allow authenticated users to perform cross-tenant operations including unauthorized workspace deletion and SSO credential access.

Cotonti 1.0.0 is vulnerable to unauthenticated remote code execution via a PHP object injection flaw in the Comments plugin's 'ci' GET parameter.

Multiple vulnerabilities in Veeam Backup & Replication prior to version 13.0.2.29 allow an attacker to cause privilege escalation and compromise data integrity.

Iranian state-sponsored actors are targeting dissidents, activists, and journalists with the CHOSEN BRICK spyware, delivered via tailored social engineering on messaging platforms to facilitate surveillance and data exfiltration.

This brief details a detection strategy for identifying potential fileless execution on Linux platforms by monitoring the memfd_create syscall for anomalous process lineage and execution paths.

Adversaries manipulate Linux firewall configurations using utilities like iptables, nftables, or ufw to create or modify rules, facilitating unauthorized network access or the disruption of security controls.

Attackers are conducting brute-force or password-spraying attacks against macOS SSH services, identified by a burst of authentication failures followed by a successful login.

Adversaries are targeting macOS hosts via SSH brute force or password spraying, which can be identified by analyzing failed authentication logs generated by the sshd-session process.

Attackers frequently abuse the native Windows whoami utility for situational awareness, specifically to verify privilege escalation and identify current user contexts, necessitating monitoring of suspicious parent-child process chains.

A remote OS command injection vulnerability in the TOTOLINK X5000R router allows unauthenticated attackers to execute arbitrary commands via the exportOvpn function.

The atomic-agents-stack library before version 1.1.0 is vulnerable to path traversal within its dashboard HTTP server, allowing remote attackers to read arbitrary files via crafted requests.