Threat briefs

Hugo versions 0.162.0 through 0.164.0 allowed arbitrary command execution by incorrectly including TailwindCSS in the default Node.js permission sandbox, enabling malicious configurations to spawn unprivileged shell processes.

This brief details a detection strategy for identifying unauthorized collection of clipboard data on Linux systems by monitoring the execution of common clipboard utilities from uncommon parent processes.

Attackers with IAM policy management permissions can escalate privileges by creating permissive policy versions or switching the default version of an existing customer-managed policy.

Adversaries may delete AWS EC2 Network Access Control Lists (ACLs) or their ingress/egress entries to disable network-level security controls and facilitate unauthorized access or data exfiltration.

Adversaries with compromised credentials may abuse the AWS IAM CreateAccessKey API to establish persistence or escalate privileges by generating new programmatic keys for other IAM users.

This brief details the detection of successful AWS API calls utilizing user-agent fingerprints associated with Kali Linux or TruffleHog, which are commonly indicative of credential testing or unauthorized access attempts.

Adversaries may suspend Amazon S3 object versioning to inhibit system recovery, facilitate unauthorized data destruction, or prepare for ransomware deployment.

Adversaries with compromised credentials may delete Amazon RDS DB instances or Aurora clusters to cause permanent data loss, disrupt operations, or destroy forensic evidence.

Adversaries with high-privilege access can leverage the DeleteFileSystem API to permanently destroy data, disrupt cloud-native applications, or remove forensic evidence.

Adversaries may invoke the DeleteLogStream API to permanently destroy log data, impairing security monitoring and concealing malicious activity during post-exploitation.

Adversaries may exploit AWS SNS by subscribing to topics using rare or unauthorized protocols to exfiltrate sensitive data or establish command-and-control communication channels.

Adversaries can abuse Amazon S3 lifecycle expiration configurations to automate the deletion of logs and forensic evidence, hindering incident investigation and response.

Adversaries with compromised credentials may abuse the AWS STS GetCallerIdentity API to verify access and identify the current account context, serving as a primary indicator of initial cloud reconnaissance.

Adversaries with high-level privileges may delete AWS Web Application Firewall (WAF) Web ACLs to disable security controls and facilitate unauthorized access to protected applications.

Adversaries targeting AWS environments may delete critical S3 bucket configurations, such as policies, encryption, and lifecycle rules, to impair security controls and conceal malicious activity.

This detection monitors for the first occurrence of an AWS identity accessing AWS Systems Manager (SSM) SecureString parameters with the decryption flag enabled, indicating potential unauthorized retrieval of stored sensitive credentials.

An adversary who has compromised an AWS service instance, such as EC2 or Lambda, may leverage assigned IAM roles to programmatically retrieve sensitive credentials from AWS Secrets Manager using the GetSecretValue API.

The threat actor UAT-10147 is deploying a sophisticated cross-platform backdoor named SPECTRE, featuring kernel-level rootkits, BYOVD defense evasion, and AI-assisted development artifacts to target IIS and Linux infrastructure.

itsourcecode Payroll System 1.0 is vulnerable to unauthenticated remote SQL injection via the Username parameter in the login function, potentially allowing full database compromise.

Heptabase contains a stored cross-site scripting (XSS) vulnerability allowing authenticated remote attackers to execute arbitrary JavaScript in the context of other users.

An unauthenticated remote arbitrary file read vulnerability (CVE-2026-78212) in 4MOSAn Management Center allows attackers to download sensitive system files via path traversal.

An unauthenticated SQL injection vulnerability in the PlanController.getImmediatePlans function of the Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System allows remote attackers to execute arbitrary SQL commands.

A prototype pollution vulnerability in the Ractive.js 'Ractive#set' function allows remote attackers to modify object prototype attributes, potentially leading to further exploitation.

An unauthenticated OS command injection vulnerability in 4MOSAn GCB Doctor allows remote attackers to execute arbitrary system commands via an unremoved ADOdb test page.

Microsoft Exchange Server contains multiple vulnerabilities that can be exploited by an authenticated remote attacker to achieve privilege escalation, arbitrary code execution, security control bypass, data manipulation, and denial-of-service.

An unauthenticated SQL injection vulnerability in itsourcecode Sales and Inventory System 1.0 allows remote attackers to manipulate the User parameter in processlogin.php to execute arbitrary SQL commands.

A critical stack-based buffer overflow vulnerability in the UTT HiPER 1250GW HTTP handler allows remote authenticated attackers to execute arbitrary code via a crafted 'pvid' parameter.

The exceljs-hardened library before version 5.0.0 is vulnerable to prototype pollution, allowing unauthenticated remote attackers to inject malicious properties into Object.prototype via crafted cell note data.

Ghostwriter versions prior to 7.1.2 are vulnerable to an authorization bypass via the report template swap endpoint, allowing authenticated attackers to enumerate and exfiltrate sensitive client-scoped template contents.

An out-of-bounds write vulnerability in the libwebsockets LECP CBOR recording function (CVE-2026-78161) allows remote attackers to trigger memory corruption via crafted CBOR data.