Threat briefs

phpIPAM versions up to 1.8.1 contain an authorization vulnerability allowing an unauthenticated attacker with a temporary share token to enumerate and exfiltrate sensitive network inventory data.

Local attackers can exploit multiple vulnerabilities in Nvidia GPU display drivers to execute arbitrary code, disclose sensitive information, or trigger a denial-of-service condition.

A local vulnerability in the Logback logging framework allows an authenticated local attacker to achieve arbitrary code execution on systems leveraging the library.

Notepad++ contains multiple vulnerabilities that an attacker can exploit to bypass security controls, steal authentication credentials, manipulate files, execute arbitrary code, or trigger denial-of-service.

An authenticated, remote attacker can exploit a vulnerability in Apache CloudStack to induce a Denial of Service condition on the infrastructure.

A local vulnerability in HashiCorp Terraform identified as CVE-2024-7956 allows local attackers to bypass security controls and access sensitive configuration information.

Adversaries leverage read access to /proc/*/maps files on Linux systems to perform memory mapping reconnaissance, a precursor to code injection, process hijacking, and credential harvesting.

Attackers are utilizing automated SQL injection payloads to perform reconnaissance and exploit web applications, leveraging diverse techniques such as boolean-blind, time-based, and stacked query attacks.

Detection and mitigation guidance for identifying timestomping activity where adversaries modify creation timestamps of executable files in sensitive system directories to evade detection.

Detection of Kubernetes pod execution requests containing suspicious socket and shell redirection patterns indicative of post-exploitation reverse shell establishment.

This brief covers the detection of attackers using Kubernetes 'exec' APIs to stage tools or exfiltrate data by invoking 'curl' or 'wget' to HTTPS endpoints from within container workloads.

Attackers are exploiting compromised pod service accounts and node identities to perform unauthorized 'get' or 'list' operations on the Kubernetes Secrets API to harvest sensitive credentials.

Detection of Kubernetes pod exec sessions accessing sensitive host and in-cluster files used for credential theft and lateral movement.

Threat actors utilize Kubernetes pod exec sessions to query cloud instance metadata endpoints for credential harvesting and unauthorized access to cloud environment resources.

High volumes of nslookup.exe executions detected via dynamic thresholding can indicate DNS tunneling used for data exfiltration or command-and-control communication.

Adversaries use 'net accounts /maxpwage:unlimited' to disable password expiration policies on Windows hosts, effectively ensuring compromised credentials remain valid for long-term persistence.

Adversaries are utilizing the Windows Filtering Platform (WFP) to create block filters that silence security agent communications, preventing the delivery of telemetry and evading detection.

Detection of unauthorized modifications to VMware ESXi security settings, such as disabling secure boot or executable verification, which are techniques used by actors like Black Basta to compromise hypervisor integrity.

This intelligence details the detection of adversaries modifying Linux profile configuration files via command-line utilities to establish persistent code execution upon system login or reboot.

An unauthenticated SQL injection vulnerability in the Online Clinic Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the Username argument in success/login.php.

An unauthenticated remote code execution vulnerability (CVE-2026-78245) exists in itsourcecode Online Pharmacy System 1.0 due to improper file validation within the user registration process.

The itsourcecode Real Estate Management System 1.0 contains an SQL injection vulnerability in search.php that allows unauthenticated remote attackers to execute arbitrary database queries.

Hugo versions 0.162.0 through 0.164.0 allowed arbitrary command execution by incorrectly including TailwindCSS in the default Node.js permission sandbox, enabling malicious configurations to spawn unprivileged shell processes.

This brief details a detection strategy for identifying unauthorized collection of clipboard data on Linux systems by monitoring the execution of common clipboard utilities from uncommon parent processes.

Attackers with IAM policy management permissions can escalate privileges by creating permissive policy versions or switching the default version of an existing customer-managed policy.

Adversaries may delete AWS EC2 Network Access Control Lists (ACLs) or their ingress/egress entries to disable network-level security controls and facilitate unauthorized access or data exfiltration.

Adversaries with compromised credentials may abuse the AWS IAM CreateAccessKey API to establish persistence or escalate privileges by generating new programmatic keys for other IAM users.

This brief details the detection of successful AWS API calls utilizing user-agent fingerprints associated with Kali Linux or TruffleHog, which are commonly indicative of credential testing or unauthorized access attempts.

Adversaries may suspend Amazon S3 object versioning to inhibit system recovery, facilitate unauthorized data destruction, or prepare for ransomware deployment.

Adversaries with compromised credentials may delete Amazon RDS DB instances or Aurora clusters to cause permanent data loss, disrupt operations, or destroy forensic evidence.