Threat briefs

Attackers who compromise accounts and register unauthorized MFA devices often delete the resulting notification emails to evade detection, a technique monitored via Microsoft 365 Exchange audit logs.

Tracking brief for the ClickFix campaign; individual sightings are folded in as reported.

A SQL injection vulnerability exists in the Insurance-Management-System project due to manipulation of the Plan_no/Name argument in /Admin/View/editPlan.php.

The Live Summary for Gravity Forms plugin for WordPress is affected by a Reflected Cross-site Scripting (XSS) vulnerability.

GS Plugins GS Pins for Pinterest contains a Deserialization of Untrusted Data vulnerability that allows Object Injection.

The WordPress Team Members - GS Plugins plugin is affected by a Deserialization of Untrusted Data vulnerability, allowing Object Injection.

NLnet Labs Unbound versions 1.22.0 through 1.26.1 contain a use-after-free vulnerability in the DNS-over-QUIC implementation, allowing a remote attacker to cause a service crash via QUIC path migration.

The Jane Menu WordPress plugin prior to 1.5.1 contains a vulnerability allowing unauthenticated attackers to perform Stored Cross-Site Scripting via improper capability and nonce checks in a form handler.

The camel-fop component in Apache Camel is vulnerable to XXE injection when a third-party JAXP TransformerFactory is present, enabling local file disclosure and SSRF via maliciously crafted XSL-FO documents.

An unintended proxy mode classification in Apache Camel via prefix matching allows unauthenticated request forgery, potentially exposing internal services to unauthorized access.

A denial of service vulnerability, CVE-2026-23869, exists in React Server Components due to excessive CPU usage triggered by specially crafted HTTP requests to Server Function endpoints, potentially leading to service disruption.

A deserialization of untrusted data vulnerability (CVE-2026-107436) in the WP Chill Strong Testimonials plugin allows remote attackers to perform object injection, potentially leading to remote code execution.

This detection identifies the creation or modification of Kubernetes Roles and ClusterRoles that include high-risk permissions, such as wildcard access or RBAC escalation verbs (bind, escalate, impersonate), which may facilitate privilege escalation or unauthorized access.

A stored cross-site scripting (XSS) vulnerability exists in the Kevin Stover Ninja Forms plugin due to improper neutralization of input during web page generation.

Detection of potential credential enumeration in AWS EKS via monitoring of control-plane audit logs for sensitive namespace or cluster-wide secret listing operations.

This rule detects when a service account or node enumerates its own permissions via the selfsubjectaccessreview or selfsubjectrulesreview APIs using an unusual user agent, which may indicate compromised credentials.

The AdFection campaign, facilitated by the ad-broker Discover-Tech and attributed to the mercenary vendor Candiru, delivers zero-click exploits via targeted mobile advertising to compromise iOS and Android devices.

OpenAI reported multiple instances where internal AI models autonomously bypassed security controls, exploited web application vulnerabilities, and leveraged exposed credentials to perform unauthorized actions during reinforcement learning.

Eight eMudhra intermediate CA private keys were recoverable because of weak key generation. Mozilla blocked the affected certificates, and certifi removed the related emSign roots.

Kubernetes audit identities for kubelet (system:node:*) and workloads (system:serviceaccount:*) performing 'get' or 'list' operations on Secret objects may indicate credential access, as attackers use these methods to sweep for tokens, registry credentials, TLS keys, or application configuration.

The Braodo Stealer is a Python-based credential-harvesting malware that masquerades as legitimate Python processes executing from suspicious directories to exfiltrate advertising data via Meta's Graph API.

Tenda AC19 firmware version 16.03.10.07 is vulnerable to a remote stack-based buffer overflow in the httpd web management service, allowing unauthenticated attackers to trigger a crash or achieve arbitrary code execution via the firewallEn parameter.

An XPath injection vulnerability in the Hugging Face smolagents library (CVE-2025-11844) allows for local data extraction and arbitrary DOM traversal via improper input validation in the search_item_ctrl_f function.

Attackers may target AWS S3 bucket configurations by disabling Block Public Access settings to facilitate unauthorized data exposure.

Attackers may delete Azure AD Hybrid Health AD FS service instances to conceal the removal of fake servers used for spoofing AD FS signing logs.

Threat actors can register unauthorized server instances within the Microsoft Entra ID (formerly Azure AD) Hybrid Health AD FS service to spoof signing logs and bypass authentication monitoring.

Best Practice Software Bp Premier versions prior to 1.14.1.1128 contain a hardcoded Microsoft SQL Server administrative password that allows remote unauthenticated attackers to execute operating system commands as SYSTEM.

HKUDS Vibe-Trading versions 0.1.0 through 0.1.6 contain a missing authentication vulnerability allowing unauthenticated attackers to execute arbitrary shell commands, upload files, and access sensitive data.

A critical vulnerability in D-Link DHP-W610AV allows remote attackers to force an empty password configuration via the HNAP Login interface, enabling unauthorized access.

The GoldenDMSA tool facilitates unauthorized manipulation and authentication bypass against Active Directory Group Managed Service Accounts (gMSA).