Briefs

A double-free vulnerability exists in FreeRDP versions 3.x through 3.27.1 within the freerdp_client_rdp_file_apply_to_settings() function, specifically when parsing the selectedmonitors field of a .rdp connection file. An attacker can exploit this by convincing a victim to open a crafted .rdp file containing oversized monitor tokens, leading to a size-controlled double-free in FreeRDP CLI clients like xfreerdp, sdl-freerdp, or wlfreerdp. This vulnerability can result in denial of service or potentially lead to arbitrary code execution.

SurrealDB versions prior to 3.1.0 are vulnerable to a session hijacking flaw (CVE-2026-63757) where unauthenticated attackers can enumerate session UUIDs via the HTTP /rpc sessions method and impersonate authenticated sessions to read, write, and delete data, leading to privilege escalation.

SurrealDB versions before 3.1.0 contain a time-of-check/time-of-use (TOCTOU) race condition in the HTTP /rpc endpoint that allows unauthenticated attackers to hijack authenticated session state and execute operations with elevated user privileges, leading to privilege escalation.

SurrealDB versions prior to 3.1.0 contain a denial of service vulnerability in the RPC use handler that panics when the 'db' parameter is set without a corresponding namespace, allowing unauthenticated attackers to crash the server by sending a malformed WebSocket message to the /rpc endpoint.

SurrealDB versions prior to 3.1.5 contain an arbitrary file read vulnerability (CVE-2026-63739) within the DEFINE ANALYZER mapper filter that allows authenticated database users with EDITOR or OWNER roles to read arbitrary files from the server filesystem by injecting file paths into query error messages, especially when the SURREAL_FILE_ALLOWLIST is unconfigured.

A vulnerability, CVE-2026-63735, in SurrealDB versions prior to 3.2.0 allows authenticated users to bypass namespace and database scope validation in custom API routes by manipulating the URL path, potentially leading to unauthorized data reading or triggering unintended operations across different tenants.

CVE-2026-14448 describes an authenticated OS command injection vulnerability in the system_certificates view of MB connect line's mbCONNECT24 and mymbCONNECT24 products, as well as Helmholz's myREX24V2 and myREX24V2.virtual products, all versions up to and including 2.20.0, allowing a high-privileged remote attacker to execute arbitrary commands leading to a total loss of confidentiality, availability, and integrity.

FreeRDP before version 3.28.0 contains a heap-based buffer overflow in the `crypto_rsa_common()` function, exploitable pre-authentication by an unauthenticated attacker crafting a malicious ciphertext to cause a denial of service on the server when a client uses RDP Standard Security.

FIN7 is leveraging Halfbaked malware to establish persistence and conduct command and control (C2) operations within compromised networks, using HTTP and TLS protocols with specific URL structures (e.g., `http://[IP_ADDRESS]/cd`) and common ports (53, 80, 8080, 443) for detection evasion and data exfiltration.

FIN7 threat group utilizes a specific Domain Generation Algorithm (DGA) for command and control (C2), characterized by domains with 4-5 alphabetic characters and specific top-level domains such as .pw, .us, .club, .info, .site, or .top, enabling persistence and continued operations within target networks.

Adversaries, notably FIN7, deploy Cobalt Strike beacons on compromised systems to establish command and control (C2) channels, utilizing specific network activity algorithms and domain naming conventions for communication over protocols like HTTP or TLS, posing a critical risk of further compromise and data exfiltration.

This brief details how attackers exploit vulnerable web applications or deploy webshells on Linux systems to achieve persistence by executing unusual shell commands from web server processes, potentially leading to payload downloads, reverse shells, or cron-like task implants.

This brief describes how attackers exploit vulnerabilities in web applications to execute suspicious shell commands via web server processes on Linux, enabling persistence, discovery, credential access, and reverse shell establishment, which can lead to full system compromise and data exfiltration.

An attacker can exploit multiple vulnerabilities in Proxmox Virtual Environment to conduct Cross-Site Scripting attacks, bypass security measures, and disclose confidential information, potentially leading to unauthorized data access or session hijacking.

Multiple vulnerabilities in IBM DB2 allow an attacker to perform a Denial of Service (DoS) attack and execute arbitrary code, which could lead to system disruption or full compromise.

Multiple vulnerabilities in Extreme Networks ExtremeXOS can be exploited by a remote, authenticated attacker to achieve privilege escalation, bypass security controls, and manipulate data on affected network devices.

A Russian-speaking threat actor known as 'bandcampro' is using Google's open-source Gemini CLI to manage and control a botnet of eight compromised dental clinic computers, facilitating activities such as password cracking, C2 infrastructure migration, and planning cryptocurrency fraud.

A high-severity vulnerability in the FreeRDP software allows a remote, unauthenticated attacker to execute arbitrary code on systems running FreeRDP, enabling system compromise without prior authentication.

An attacker can exploit multiple vulnerabilities in IBM Langflow Desktop OSS to gain administrator privileges, execute arbitrary code, bypass security measures, manipulate and disclose data, or cause a denial-of-service condition, leading to full system compromise and data integrity/confidentiality breaches.

A remote, unauthenticated attacker can exploit multiple, unspecified vulnerabilities in WordPress to execute arbitrary program code, potentially leading to a complete compromise of the web server hosting the instance.

An authenticated remote attacker can exploit a vulnerability within ProFTPD to initiate a denial-of-service attack, leading to the unavailability of the FTP service. This flaw could be triggered by legitimate users or adversaries with valid credentials, causing operational disruption.

A remote, unauthenticated attacker can exploit a SQL Injection vulnerability within the Shibboleth Service Provider software, allowing them to perform unauthorized database queries and potentially extract or manipulate sensitive data.

Cruciferra is a sophisticated crypter-as-a-service, written in Mono, actively developed and sold to multiple cybercriminal threat actors who use it to deliver a wide range of remote access trojans and infostealers, employing extensive defense evasion techniques like BYOVD-based EDR tampering, Process Ghosting, and unique cryptographic obfuscation via email-based phishing campaigns.

A critical authentication bypass vulnerability, CVE-2026-16242, exists in the Konnectivity proxy-server configuration for hosted control planes, allowing a remote unauthenticated attacker to connect as an agent and potentially proxy, inspect, modify, or drop control-plane-to-node traffic due to improper client certificate validation.

A high-severity use-after-free vulnerability, CVE-2026-53401, has been identified in the Linux kernel's fbdev subsystem affecting omap2 processors, potentially allowing for privilege escalation or denial of service.

A vulnerability identified as CVE-2026-63829 affects the `ip_gre` module in the Linux kernel, involving a security fix to ensure that the `changelink` operation properly requires `CAP_NET_ADMIN` capabilities within the device's network namespace, addressing a potential privilege escalation or security bypass scenario.

A vulnerability, CVE-2026-63825, has been disclosed for the 'gcov' utility, which is part of the GNU Compiler Collection, involving concurrent access crashes fixed by using atomic counter updates to ensure thread-safe operations, potentially leading to system instability or denial of service due to race conditions during data access.

A memory exhaustion vulnerability, CVE-2026-62389, exists in the 'ws' WebSocket library versions prior to 8.21.1, allowing attackers to exhaust server memory via incomplete fragmented WebSocket messages and cause denial of service.

A potential out-of-bounds write vulnerability, CVE-2026-45784, has been identified in the `rust-openssl` library's `CipherCtxRef::cipher_update_inplace` function when processing AES-KW-PAD ciphers, which could lead to unexpected behavior or potential exploitation by corrupting memory.

The Microsoft Security Response Center has published information concerning CVE-2026-63833, a privilege escalation vulnerability in the Linux kernel's `ntfs3` module that allows direct userspace writes to reserved `$LX*` extended attributes.