Threat briefs

NoMachine software contains multiple vulnerabilities that permit a local attacker to escalate privileges to higher authority levels on the affected host.

Multiple vulnerabilities in Fleet enable a remote, unauthenticated attacker to cause a Denial of Service state, impacting service availability.

Red Hat Quay and Red Hat Enterprise Linux are affected by vulnerabilities in the pypdf and urllib3 libraries, alongside URI handling flaws, allowing remote unauthenticated attackers to perform Denial of Service or security bypasses.

This brief highlights the risk of unauthorized AWS IAM access key creation, where one IAM user generates keys for another, potentially indicating account takeover or privilege escalation.

Adversaries leverage legitimate remote access tools for command-and-control and persistence, requiring network monitoring to identify unauthorized usage of applications such as AnyDesk, TeamViewer, and LogMeIn.

This brief provides detection logic for identifying network traffic associated with dual-use remote access tools like AnyDesk, TeamViewer, and LogMeIn within Cisco Secure Firewall logs.

This brief details the detection of potential reverse shell and C2 communication attempts by identifying outbound traffic over non-standard, suspicious port patterns within Cisco Secure Firewall logs.

This detection monitors for the creation of files associated with known remote access utilities, which adversaries frequently deploy to establish C2 channels and persistent access.

An information disclosure vulnerability (CVE-2026-84180) in the camel-knative HTTP consumer allows remote attackers to retrieve internal application details, stack traces, and configuration data via intentional route failures.

An integrity-verification downgrade in camel-crypto-pgp allows attackers to bypass modification detection by using legacy OpenPGP packets, potentially leading to the acceptance and decryption of malleable ciphertext.

A vulnerability in the camel-thrift component, CVE-2026-85245, allows cross-tenant data disclosure by reusing a shared object instance for unmarshalling Thrift payloads.

CVE-2026-85246 allows remote attackers to trigger route failures in Apache Camel Mina consumers, causing the disclosure of internal exception details, file paths, and hostnames over TCP/UDP sockets.

A deserialization of untrusted data vulnerability in the Quiz And Survey Master WordPress plugin (CVE-2026-111408) allows for object injection, potentially leading to arbitrary code execution.

A path traversal vulnerability in the MapSVG plugin, tracked as CVE-2026-111398, allows unauthenticated attackers to read arbitrary files from the hosting server.

CVE-2026-110887 is a critical code injection vulnerability in the HivePress WordPress plugin that permits unauthenticated remote code inclusion.

The Quiz Maker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper input sanitization, potentially allowing attackers to execute arbitrary scripts in a user’s browser.

A missing authentication vulnerability in the Remote Control Server component of eremef bandcamp-player allows remote attackers to bypass security controls via the remoteEnabled argument.

The REF8801 threat actor is distributing malicious npm packages targeting Web3 developers to deploy information stealers, backdoors, and hijack AI agent traffic.

Adversaries are leveraging the Azure CLI on compromised Windows hosts to manipulate Microsoft Entra ID user accounts for persistent access and stealthy operation.

Yamaha VOCALOID6 Editor is vulnerable to XML External Entity (XXE) injection via specially crafted project files, enabling unauthorized sensitive information disclosure or denial-of-service.

This detection targets unauthorized modifications to Windows Security Center registry keys used by threat actors to spoof or disable antivirus product reporting.

This brief provides detection logic for identifying potential DLL sideloading attempts that leverage legitimate antivirus software components to achieve persistence or privilege escalation.

A critical vulnerability, CVE-2026-76740, in HPE Compute Scale-up and Superdome Flex servers allows unauthenticated remote attackers to execute arbitrary commands via the Rack Management Controller (RMC).

A vulnerability in bootc allows for the execution of arbitrary unsigned container content as the host root filesystem due to insecure default signature policies.

Detection logic for identifying when known LOLBins write files to suspicious or uncommon directories to evade security controls.

Defendnot is a hacktool that impairs Windows Defender by abusing the Windows Security Center API to register itself as a fraudulent antivirus product.

The Defendnot hacktool is deployed via PowerShell one-liners to disable Windows Defender by registering a malicious, fake antivirus product through undocumented WSC APIs.

The Defendnot hacktool utilizes a custom scheduled task for persistence and abuses the Windows Security Center API to register itself as a fake antivirus product to disable Windows Defender.

A remote denial of service vulnerability in the SGLang library allows unauthenticated attackers to disrupt service via the Expert-Distribution Recording Endpoint (CVE-2026-112082).

Detection of network service discovery and enumeration activities on MacOS systems using common tools like nmap, netcat, and telnet.