Threat briefs

CodeIgniter Framework versions prior to 4.7.4 contain a path traversal vulnerability in the UploadedFile::move() method that allows attackers to write files to arbitrary filesystem locations when unsanitized client filenames are processed.

A SQL injection vulnerability in CodeIgniter4 (CVE-2026-63221) allows unauthenticated attackers to execute arbitrary SQL via improperly handled where() clauses when using the deleteBatch() method.

CodeIgniter4 versions before 4.7.4 contain an unsafe file upload validation bypass in 'is_image' and 'mime_in' rules, allowing attackers to upload arbitrary files that could result in remote code execution.

A vulnerability in Apple macOS allows a remote, authenticated attacker to bypass security restrictions on affected versions of Sonoma, Sequoia, and Tahoe.

This brief details the detection of suspicious outbound network connections initiated by Netcat (nc, ncat) utilities on Linux systems, which are frequently used by threat actors for C2 communication and data exfiltration.

The ATN-B1 CPDLC protocol is susceptible to message injection and denial-of-service attacks due to reliance on unauthenticated, clear-text radio frequency communication.

An authentication bypass in the Grav CMS scheduler-webhook plugin allows unauthenticated attackers to trigger pre-configured scheduled jobs via the /scheduler/webhook endpoint.

ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component that allows arbitrary command execution via malicious pickle file injection.

SourceCodester Photo Share Website 1.0 contains an SQL injection vulnerability in the login function of the /social/ajax.php script, allowing remote attackers to execute arbitrary SQL commands via the email parameter.

A critical stack-based buffer overflow in the Tenda W6-S web management interface allows unauthenticated remote attackers to cause a denial of service or potentially execute arbitrary code.

Weaver E-cology 9.0 versions prior to 10.52 are vulnerable to unauthenticated arbitrary file upload via the /workrelate/plan/util/uploaderOperate.jsp endpoint, allowing remote code execution.

An insecure mass-assignment vulnerability in the Craft CMS user element save action allows authenticated users with specific permissions to modify passwords without requiring the current password or elevated verification.

Multiple vulnerabilities in Internet Systems Consortium BIND allow a remote, unauthenticated attacker to trigger a Denial of Service condition through network-based exploitation.

FFmpeg versions 0.5 through 8.9 are vulnerable to a signed integer overflow in the DVB subtitle parser that can be triggered via a crafted WTV file to achieve remote code execution.

Progress Telerik UI for ASP.NET AJAX is affected by a suite of thirteen critical vulnerabilities, including insecure deserialization, path traversal, XXE, and SSRF, which collectively enable remote code execution and data theft.

Attackers may assign a UID of 0 to a non-privileged user account using the 'usermod' utility to establish persistent root-level access on Linux systems.

Adversaries leverage the creation of malicious udev rules in system directories to achieve persistent, elevated code execution triggered by device events.

Adversaries, including those using the PANIX post-exploitation framework, are abusing XDG autostart directories on Linux to achieve persistence via malicious .desktop files.

Detection of unauthorized system shell and utility execution originating from Redis server processes indicative of post-exploitation activity or sandbox escapes like CVE-2022-0543.

Attackers may deploy Docker containers with elevated privileges to achieve persistence or perform container escapes on compromised Linux hosts.

Detection of docker build commands executed on Dockerfiles located in temporary directories, a common indicator of unauthorized container deployment or persistence attempts on Linux hosts.

The PostgreSQL 'COPY ... PROGRAM' feature enables users with elevated privileges to execute arbitrary operating-system commands, a technique frequently abused by attackers to deploy cryptominers or establish persistence.

Detection of malicious actors accessing sensitive shell history files using common command-line utilities to harvest credentials or reconnaissance data on compromised Linux hosts.

This brief addresses the detection of the 'id' command executed by the root user on Linux systems, a behavior frequently utilized by attackers for situational awareness during post-exploitation and privilege escalation verification.

Attackers can escalate privileges on Linux systems by abusing the PYTHONPATH environment variable to force privileged processes, specifically the NeedRestart utility (CVE-2024-48990), to load malicious shared objects.

Nimbuspwn refers to a collection of Linux privilege escalation vulnerabilities in the networkd-dispatcher service that attackers can exploit via directory traversal to achieve root-level code execution.

Attackers can achieve persistence or privilege escalation by creating or modifying scripts in the '/etc/update-motd.d/' directory, which execute automatically upon user login.

This detection identifies potential persistence on Linux systems by monitoring for unauthorized file creation or modification within the /lib/systemd/system-generators/ directory, which executes during the boot sequence.

Detection of root-level execution of binaries from volatile shared memory directories (/dev/shm/ and /run/shm/) used by threat actors for fileless persistence and forensic evasion.

This brief describes a detection methodology for identifying malware utilizing DNS TXT records to retrieve commands via PowerShell to bypass network egress restrictions.