Threat briefs

Multiple vulnerabilities in Internet Systems Consortium BIND can be exploited by a remote attacker to conduct a denial of service attack or bypass security measures.

Multiple vulnerabilities in NGINX Plus and NGINX can be exploited by an attacker to perform a denial of service attack, manipulate data, bypass security measures, and potentially execute arbitrary program code, leading to significant impact.

Multiple vulnerabilities in F5 BIG-IP and F5OS allow an attacker to bypass security mechanisms, escalate privileges, cause a denial-of-service condition, perform a cross-site scripting attack, and disclose or manipulate information.

CrowdStrike's new CNAPP capabilities enhance cloud risk assessment by incorporating application-layer visibility, adversary intelligence, and configuration change tracking, enabling security teams to prioritize remediation based on real-world threat actor behavior such as LABYRINTH CHOLLIMA and SCATTERED SPIDER.

Gigabyte Control Center has an Arbitrary File Write vulnerability (CVE-2026-4415) that allows unauthenticated remote attackers to write arbitrary files to any location on the underlying operating system, leading to arbitrary code execution or privilege escalation.

CVE-2026-2328 describes a vulnerability where an unauthenticated remote attacker can exploit insufficient input validation to access backend components beyond their intended scope via path traversal, leading to the exposure of sensitive information.

An integer overflow vulnerability in Tinyproxy's HTTP chunked transfer encoding parser (versions <= 1.11.3) allows an unauthenticated remote attacker to cause a denial of service by sending a crafted chunk size that bypasses validation, leading to resource exhaustion.

The Tycoon2FA PhaaS platform, which facilitates MFA bypass and email account compromise, experienced a temporary decrease in activity following a takedown operation, but campaign volumes have since returned to pre-disruption levels, and TTPs remain consistent.

The aquasecurity/trivy-action GitHub Action was compromised via git tag repointing, injecting a multi-stage credential stealer into CI/CD pipelines, potentially exposing secrets, credentials, and infrastructure.

The trivy-action GitHub Action, a popular open-source vulnerability scanner used in CI/CD pipelines, was compromised via git tag repointing to inject a multi-stage credential stealer.

CrowdStrike introduces agentic MDR and SOC Transformation Services, combining deterministic automation, adaptive AI agents, and human oversight to enhance breach prevention and SOC modernization.

CrowdStrike's enhanced Cloud Native Application Protection Platform (CNAPP) improves risk prioritization by incorporating threat intelligence from groups like LABYRINTH CHOLLIMA and SCATTERED SPIDER, providing context on application-infrastructure dependencies, and identifying configuration changes leading to exposure.

CrowdStrike Falcon Cloud Security enhances its CNAPP capabilities, incorporating adversary intelligence to prioritize cloud risks based on threat actor behavior, particularly focusing on groups like LABYRINTH CHOLLIMA and SCATTERED SPIDER, to enable security teams to understand and remediate cloud exposures more effectively.

The trivy-action GitHub Action was compromised via git tag repointing, injecting a multi-stage credential stealer that ran before the legitimate scanner, impacting CI/CD pipelines.

CrowdStrike is introducing new capabilities to secure AI agents and govern shadow AI across endpoints, SaaS, and cloud environments by providing detection and response (AIDR) for desktop AI applications, discovery of AI-related components, and runtime security for agents built in Microsoft Copilot Studio to combat attacks like living off the AI land (LOTAIL) by securing the agentic interaction layer.

The Tycoon2FA phishing-as-a-service (PhaaS) platform, disrupted by law enforcement on March 4, 2026, has shown a resurgence in activity, enabling cybercriminals to bypass MFA and compromise email accounts using adversary-in-the-middle (AITM) techniques.

The Tycoon2FA phishing-as-a-service (PhaaS) platform, disrupted by law enforcement on March 4, 2026, has shown a resurgence in activity, enabling cybercriminals to bypass MFA and compromise email accounts using adversary-in-the-middle (AITM) techniques.

A supply chain attack compromised the trivy-action GitHub Action, a popular open-source vulnerability scanner used in CI/CD pipelines, with the attacker retroactively poisoning 76 of 77 release tags to steal credentials.

CrowdStrike's Falcon Cloud Security CNAPP capabilities provide risk-based insights, application-infrastructure interaction understanding, adversary-aligned risk prioritization, and configuration change tracing, utilizing threat intelligence on over 280 groups like LABYRINTH CHOLLIMA and SCATTERED SPIDER to prioritize risks based on TTPs, discovering shadow AI activity and preventing sensitive data exposure.

CrowdStrike's Falcon Next-Gen SIEM is expanding to support third-party EDR solutions, starting with Microsoft Defender, to unify detection, investigation, and response without requiring a Falcon sensor.

The aquasecurity/trivy-action GitHub Action was compromised via git tag repointing, injecting a multi-stage credential stealer into CI/CD pipelines, allowing for the theft of secrets and credentials.

CrowdStrike introduces agentic MDR and SOC Transformation Services combining deterministic automation, AI agents, and human accountability to accelerate breach response and modernize security operations.

CrowdStrike's Charlotte AI AgentWorks aims to enhance security operations by providing a platform for building and orchestrating AI-powered security agents, integrating with leading AI models and offering features like mission-ready agents and workflow automation to improve analyst efficiency and decision accuracy.

CrowdStrike enhances its CNAPP by incorporating adversary-informed risk prioritization, including application-layer analysis and correlation of cloud risks with threat actor profiles like LABYRINTH CHOLLIMA and SCATTERED SPIDER, to enable better risk understanding and remediation.

CrowdStrike introduces agentic MDR and SOC Transformation Services to enhance SOC capabilities with AI and automation, emphasizing data foundations, workflows, and governance for improved detection and response across diverse environments.

The Tycoon2FA Phishing-as-a-Service platform, used to bypass MFA and compromise email accounts, has demonstrated resilience following a law enforcement takedown, with campaign activity returning to pre-disruption levels and TTPs remaining consistent.

The aquasecurity/trivy-action GitHub Action was compromised via git tag repointing, where 76 of 77 release tags were retroactively poisoned with malicious code that executes a multi-stage credential theft operation.

CrowdStrike Falcon Cloud Security introduces new CNAPP capabilities including Application Explorer and adversary intelligence to prioritize cloud risks based on threat actor behavior, enabling security teams to focus on documented intrusion patterns by groups like LABYRINTH CHOLLIMA and SCATTERED SPIDER.

GitLab CE/EE versions 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 are vulnerable to improper authorization checks in Jira Connect installations, allowing an authenticated user with minimal workspace permissions to obtain installation credentials and impersonate the GitLab application.

Xiongmai DVR/NVR devices are vulnerable to root OS command injection (CVE-2026-34005) due to shell metacharacters in the HostName value, exploitable via an authenticated DVRIP request, potentially allowing arbitrary command execution with root privileges.