Threat briefs

An authenticated OS command injection vulnerability in the AUTOM8N WHM plugin allows attackers to execute arbitrary system commands with root privileges via unsanitized CGI parameters.

PHPNuxBill versions through 2025.3.20 are vulnerable to an unauthenticated time-based blind SQL injection in the radius.php FreeRADIUS REST endpoint, allowing credential and data exfiltration.

The snappy-java library prior to version 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to trigger a JVM OutOfMemoryError via crafted input.

HortusFox hortusfox-web through version 6.3 is vulnerable to unrestricted file uploads in the PlantAttachmentModel, allowing authenticated attackers to execute remote code or perform stored cross-site scripting.

KodExplorer before version 4.55 contains a path traversal vulnerability in the unzip_pre_name() function that allows authenticated attackers to perform arbitrary file overwrites and achieve remote code execution.

Strawberry GraphQL's PermissionExtension incorrectly handles synchronous custom permission checks that return awaitable objects, allowing unauthorized access to protected fields due to Python's truthy evaluation of unawaited coroutines.

CVE-2026-86405 describes a critical signature validation flaw in the Sipay PrestaShop Virtual POS Module allowing attackers to spoof transaction integrity checks and manipulate payment requests.

An improper cryptographic signature verification flaw in the Sipay OpenCart Virtual POS Module allows remote attackers to spoof signatures and manipulate transaction processing.

This brief describes a detection mechanism for identifying potential container escapes and host-level privilege escalation via the unauthorized use of the mount utility within privileged containers.

An unauthenticated path traversal vulnerability in the gvproxy component of gvisor-tap-vsock allows attackers to delete arbitrary files on the host filesystem via the /services/forwarder/expose endpoint.

A vulnerability in the Bootstrap framework allows for Cross-Site Scripting (XSS) attacks by an unauthenticated remote attacker, potentially leading to arbitrary script execution in a user's browser.

Apache CXF is vulnerable to multiple security flaws including security constraint bypass, data manipulation, unauthorized data disclosure, open redirection, and denial-of-service conditions associated with CVE-2024-37554, CVE-2024-38709, and CVE-2024-38710.

IBM App Connect Enterprise contains multiple vulnerabilities including CVE-2024-45063, CVE-2024-45064, and CVE-2024-45065, which may allow attackers to bypass security, conduct denial-of-service, or disclose sensitive information.

MIT Kerberos contains multiple vulnerabilities that enable a remote, authenticated attacker to trigger a Denial of Service condition on targeted systems.

MariaDB Connector/Node.js is vulnerable to multiple security flaws, including SQL injection, information disclosure, data manipulation, and denial-of-service, allowing remote unauthenticated attackers to compromise data.

A local attacker can exploit a vulnerability in Zammad to perform privilege escalation on the host system.

JHipster is affected by multiple vulnerabilities allowing a remote, authenticated attacker to execute Cross-Site Scripting (XSS) or SQL Injection attacks, compromising application integrity.

Hazelcast contains an authorization bypass vulnerability in the IMap Predicates API allowing unauthenticated remote code execution on cluster members via malicious predicate input.

Malware families such as NjRAT and BlankGrabber utilize the 'ping 0 -n' command to introduce execution delays, a technique employed to evade sandbox analysis and time the self-deletion of malicious artifacts.

Attackers are abusing Windows SSH configuration features 'ProxyCommand' and 'LocalCommand' to execute arbitrary scripts and establish command-and-control channels via living-off-the-land binaries.

Threat actors abuse the Windows Task Scheduler service to execute malicious code and maintain persistence by spawning shell and scripting binaries directly from the svchost.exe service process.

Adversaries are leveraging trusted .NET utilities spawned by scripts in user-writable directories to execute code and maintain persistence, a technique observed in recent VIP Keylogger campaigns.

The Windows Program Compatibility Assistant (pcalua.exe) is being abused as a living-off-the-land binary to execute arbitrary processes and bypass command-line protections.

The DCRat malware utilizes a forkbomb technique, spawning rapid, high-volume processes of cmd.exe and notepad.exe to induce system instability and resource exhaustion.

Adversaries utilize wscript.exe with VBScript command-line arguments to execute arbitrary code and evade process monitoring defenses.

Adversaries frequently utilize the ping command as a stealthy sleep mechanism to introduce execution delays, aiming to bypass automated sandboxing and dynamic analysis by chaining commands with operators.

This brief details the detection of JScript files executed via cscript.exe, a technique frequently associated with the FIN7 threat actor's command execution lifecycle.

Detection of unauthorized use of the chmod utility to grant execution permissions to files within container environments, often indicative of post-exploitation or privilege escalation activity.

The US government disrupted infrastructure supporting Integrity Technology Group tools MicroScan and FishHub, which Chinese state-sponsored actors, including Flax Typhoon, used to compromise critical infrastructure.

The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress are vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization in the Popup Builder's save_popup_content AJAX action.