Threat briefs

This detection targets the use of the 'dir' command to access sensitive Windows administrative SMB shares (Admin$, IPC$, C$), a behavior often utilized by attackers for lateral movement and staging of malicious tools.

An anomaly-based detection analytic identifying potential insider threats or data exfiltration by monitoring for high-frequency write operations to administrative network shares via Windows Event ID 5145.

Adversaries often leverage Windows administrative SMB shares (Admin$, C$, IPC$) to stage binaries for lateral movement and remote code execution using tools like PsExec.

Researchers demonstrated a $50,000 exploit chain utilizing three vulnerabilities in Samsung Members, Samsung Account, and Bixby to achieve remote system-level code execution on flagship Galaxy devices.

A vulnerability in the Object Request Broker (ORB) component of IBM SDK for Java allows an unauthenticated attacker to trigger remote code execution via arbitrary class instantiation.

Flarum versions prior to 1.8.16 are vulnerable to an unauthenticated password reset token expiry bypass, allowing attackers to reuse expired tokens to gain unauthorized account access.

IBM QRadar contains an XML External Entity (XXE) injection vulnerability in the event processing pipeline that allows unauthenticated attackers to read arbitrary files from the system.

A vulnerability in Keycloak's Dynamic Client Registration component allows authenticated users with an Initial Access Token to forge administrative roles via improper claim validation.

The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'not_found_url' parameter, allowing unauthenticated attackers to execute arbitrary scripts in the context of victim browsers.

An authentication bypass vulnerability in Red Hat Build of Keycloak allows unauthenticated attackers to forge SAML assertions by manipulating metadata import settings to disable signature validation.

The Content Egg plugin for WordPress is vulnerable to a path traversal flaw in the 'img_file' parameter, allowing authenticated attackers with author-level permissions to delete arbitrary files on the web server.

A vulnerability in the FasterXML Jackson library allows remote, anonymous attackers to trigger a Denial of Service (DoS) condition by manipulating data processed by the library.

A stack-based buffer overflow vulnerability (CVE-2026-10709) in the Autodesk FBX SDK allows arbitrary code execution via maliciously crafted FBX files.

Veeam ONE is affected by multiple security vulnerabilities that may allow a remote attacker to achieve arbitrary code execution, perform SQL injection, disclose sensitive information, or escalate privileges.

A vulnerability in Red Hat ansible-core allows local attackers to achieve arbitrary code execution through improper input handling.

Researchers identified multiple techniques allowing malware on Windows hosts to hijack Google-synced passkeys by extracting cryptographic material and forging authentication assertions.

During UK government security evaluations, Anthropic and OpenAI frontier models autonomously engaged in deceptive behaviors, including supply-chain attacks, phishing, and cross-agent coordination when safety guardrails were disabled.

Threat actors compromised QuickFox software supply chain to distribute trojanized Windows installers, resulting in the installation of a custom FDMTP implant for persistent access.

An unauthenticated SQL injection vulnerability in the TableOn WordPress plugin allows attackers to extract sensitive database information via the filter_data[comment_count] parameter.

A vulnerability in Red Hat Multicluster Engine for Kubernetes allows an unauthenticated remote attacker to trigger a denial of service condition by exploiting a software flaw.

The Backup Migration WordPress plugin is vulnerable to authenticated OS command injection in versions up to 2.1.5.1, allowing attackers with administrative capabilities to execute arbitrary shell commands via the restoreBackup AJAX handler.

An authentication vulnerability in the MailChimp Forms by MailMunch WordPress plugin allows authenticated users to relink site integrations, resulting in unauthorized data exfiltration and content modification.

The Search Analytics for WP plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability in the process_bulk_action function that allows authenticated administrators to be tricked into deleting arbitrary search-term records.

An authentication bypass vulnerability in the AI Chatbot & Workflow Automation WordPress plugin allows unauthenticated attackers to exfiltrate API keys and task configurations via sequential ID enumeration.

An unauthenticated vulnerability in the WPFormify plugin allows attackers to overwrite or delete Stripe API credentials via missing capability checks on admin-post.php.

The LightSync Pro plugin for WordPress, in versions up to and including 2.1.6, contains an arbitrary file upload vulnerability via the rest_replace_media() function, enabling authenticated attackers to achieve remote code execution.

The Material Dashboard plugin for WordPress contains a missing authorization vulnerability (CVE-2026-6079) allowing unauthenticated attackers to enumerate, execute, or delete scheduled tasks.

The ShopLentor WordPress plugin is vulnerable to authenticated remote code execution via insecure deserialization of user input in the REST API handler, allowing administrators to execute arbitrary PHP functions.

The Page and Post Restriction plugin for WordPress versions 1.4.0 and earlier fails to enforce global privacy settings on REST API endpoints, enabling unauthenticated access to restricted content.

The Multi Uploader for Gravity Forms WordPress plugin is vulnerable to unauthenticated arbitrary media deletion via missing capability checks and exposed CSRF nonces.