Threat briefs

Adversaries may use the systemsetup or launchctl commands to programmatically enable remote SSH services on macOS to facilitate persistence and lateral movement.

This detection identifies potential credential theft by monitoring untrusted processes or osascript attempting to access sensitive browser session cookies and password databases on macOS.

Adversaries abuse native macOS utilities like 'dscl', 'mkpassdb', and 'defaults' to extract user password hashes from ShadowHashData or system plist files to facilitate credential cracking and lateral movement.

Adversaries frequently use standard compression utilities like tar, zip, or gzip to aggregate sensitive files such as SSH keys, cloud credentials, and configuration files prior to exfiltration.

Exploitation attempts targeting Juniper Networks J-Web interface via the webauth_operation.php endpoint to achieve remote code execution.

An insecure deserialization vulnerability in Wazuh cluster communication allows a compromised worker node to achieve remote code execution as root on the master node.

Vitec Flamingo version 4.12.2 contains an unauthenticated OS command injection vulnerability (CVE-2026-60121) in the `admin/ajax/ping.php` endpoint, allowing remote attackers to execute arbitrary commands with root privileges via a double-evaluation flaw in shell argument handling through the `host` POST parameter.

Unauthenticated attackers can perform Stored Cross-Site Scripting (XSS) via the 'cr_local_forms_submit' AJAX action in Customer Reviews for WooCommerce versions 5.106.0 and below.

WP Rocket versions up to and including 3.21.0.1 are vulnerable to unauthenticated Stored Cross-Site Scripting via the rocket_beacon AJAX endpoint.

A path traversal and trust inheritance vulnerability in the gitoxide Rust crates allows attackers to access arbitrary git configurations by crafting malicious .gitmodules files.

Gitoxide versions prior to 0.52.1 contain a path traversal vulnerability via symlink following that allows attackers to inject arbitrary file contents into submodule configuration metadata.

An improper URL parsing flaw in the gitoxide gix-url crate enables credential theft by causing the gix-transport identity guard to transmit HTTP Basic Authorization headers to unauthorized hosts via crafted redirects.

Multiple vulnerabilities in the FFmpeg multimedia framework can be exploited by a remote, anonymous attacker to trigger a Denial of Service condition, leading to service disruption.

Composer contains multiple vulnerabilities that allow a remote attacker to bypass security restrictions and execute arbitrary code on systems using the dependency manager.

SUSE Rancher contains multiple vulnerabilities that enable unauthenticated attackers to trigger denial of service, perform unauthorized information disclosure, and bypass security controls.

Rapid7 Velociraptor is affected by multiple vulnerabilities allowing an authenticated remote attacker to perform arbitrary file manipulation, security bypass, remote code execution, and privilege escalation.

SpeechBrain versions prior to 1.1.1 are vulnerable to arbitrary code execution when the Checkpointer component parses maliciously crafted CKPT.yaml files using PyYAML's unsafe loader.

SvelteKit versions 2.49.0 through 2.53.2 are susceptible to a denial-of-service attack due to a deserialization expansion issue in the experimental remote functions feature.

Authenticated administrators can exploit an insecure plugin handling mechanism in Budibase versions prior to 3.41.3 to achieve remote code execution via malicious JavaScript tarball uploads.

An SSRF vulnerability in Budibase backend-core allows authenticated users to bypass blacklist restrictions and perform requests against internal services in the 100.64.0.0/10 address range.

An unauthenticated stored Cross-Site Scripting (XSS) vulnerability in the Amelia WordPress plugin allows attackers to inject malicious scripts into appointment bookings, which execute in an administrator's browser context.

The wpForo Forum plugin for WordPress contains an unauthenticated SQL injection vulnerability in the referer parameter, allowing attackers to execute arbitrary SQL commands for data extraction.

An authentication bypass vulnerability in the WPMU DEV Dashboard WordPress plugin allows unauthenticated attackers to forge an administrator session by exploiting flawed HMAC validation in the Hub SSO flow.

An improper input neutralization vulnerability (CVE-2026-40541) in Synology Chat Server allows authenticated remote attackers to achieve arbitrary file access and denial-of-service within the DSM environment.

ServiceNow Now Platform and AI Platform are vulnerable to multiple flaws enabling arbitrary code execution, privilege escalation, and SQL injection, risking full environment compromise.

CVE-2022-28601 allows an authenticated low-privileged user to bypass 2FA by overwriting a target account's associated phone number via the plugin's profile management endpoint.

SQLPad versions prior to 6.10.1 contain a blind template injection vulnerability (CVE-2022-0944) allowing authenticated high-privileged users to execute arbitrary system commands via the /api/test-connection endpoint.

An attacker attempts to exploit the CVE-2023-42793 vulnerability in JetBrains TeamCity On-Premises by sending a malicious POST request to gain administrative access and achieve remote code execution.

This brief describes the detection of GET requests to the spinstall0.aspx webshell, commonly deployed after exploiting CVE-2025-53770 in Microsoft SharePoint, indicating potential command execution, data exfiltration, or credential harvesting.

The Optimole WordPress plugin is vulnerable to stored cross-site scripting due to improper sanitization of the above_fold_images parameter, allowing unauthenticated attackers to execute arbitrary JavaScript in victim browsers.