Threat briefs

A vulnerability in AsyncHttpClient causes sensitive credentials and request details to be leaked to unintended hosts when a request replay or failover is triggered.

An out-of-bounds buffer read in msgpack5 versions prior to 6.1.0 (CVE-2026-107302) triggers an unhandled RangeError when encountering truncated map32 headers, leading to potential application-level denial of service.

JHipster-generated reactive applications are vulnerable to SQL injection via the 'sort' parameter in paginated endpoints, allowing authenticated attackers to execute arbitrary SQL commands.

Coraza WAF silently drops parameters when the configured argument limit is reached, allowing attackers to evade security rules by flooding requests with filler parameters that force malicious payloads to be ignored by the WAF engine.

Handlebars (v4.0.0-4.7.9) is vulnerable to a prototype-access deny list bypass where own property checks permit the retrieval of the Function constructor, enabling remote code execution when allowProtoMethodsByDefault is enabled.

CVE-2026-92555 allows for the unauthorized extraction of sensitive information via the 'Pull Data from System Resources' function in AKINSOFT WOLVOX Control Panel versions 26.02.25.

Checkmk is affected by multiple vulnerabilities, including CVE-2024-23334 through CVE-2024-23338, which may allow unauthenticated or authenticated attackers to perform cross-site scripting, information disclosure, or data manipulation.

Multiple vulnerabilities in Gradle allow remote attackers to achieve arbitrary code execution with the privileges of the user running the build, disclose sensitive information, or trigger a denial-of-service condition.

The PostgreSQL JDBC Driver is susceptible to multiple vulnerabilities, including CVE-2022-21724 and CVE-2022-31197, that allow remote attackers to manipulate data and disclose sensitive information.

A vulnerability in the Resteasy component of Red Hat Enterprise Linux allows a remote, unauthenticated attacker to disclose sensitive information.

Apache Jackrabbit contains multiple vulnerabilities that allow remote, unauthenticated attackers to bypass security restrictions and perform unauthorized file manipulation or data corruption.

Cisco has released patches for three critical vulnerabilities, tracked as CVE-2026-76498, CVE-2026-76499, and CVE-2026-76500, discovered during an internal security review of the Application Policy Infrastructure Controller.

Integrity Technology Group, a Chinese for-profit entity, is conducting multi-year cyber espionage targeting government, healthcare, and religious institutions using automated vulnerability scanning, credential harvesting, and specialized data exfiltration tools.

Adversaries leverage oversized, base64-encoded command lines in scripting interpreters to evade security telemetry that truncates or ignores excessively large command-line arguments.

Adversaries perform OAuth phishing by tricking users into granting malicious applications high-risk delegated scopes in Entra ID, enabling persistent, silent access to mail, files, and chat data via long-lived refresh tokens.

Adversaries may perform local privilege escalation by abusing the Windows Secondary Logon service to spawn processes with alternate user credentials.

Adversaries can establish persistence on Linux systems by modifying XDG Autostart entries to execute malicious scripts or binaries that initiate unauthorized network connections upon user login.

Adversaries modify critical SSH binaries and libraries on Linux systems to establish persistence, gain unauthorized access, or harvest credentials through patched sensitive functions.

Adversaries may abuse the Telnet protocol to move laterally within a network, necessitating monitoring of internal Telnet connections to identify unauthorized remote access attempts.

Telnet is a legacy protocol frequently abused for unauthorized remote access and data exfiltration due to its lack of encryption, necessitating monitoring of outbound traffic to publicly routable IP addresses.

This brief outlines the detection of Linux shell processes that are backgrounded via the ampersand operator by unusual parent processes, a technique used to evade monitoring and obfuscate process hierarchies.

Adversaries leverage the dmidecode utility on Linux hosts to perform hardware and system profiling, often using parent shells to execute collection commands for lateral movement and targeted exploitation.

This detection rule identifies potential defense evasion activity on Linux systems where a non-root user modifies file permissions within temporary directories to stage or execute malicious payloads.

This detection logic identifies adversaries attempting to maintain persistence or harvest credentials by modifying OpenSSH binaries or configuration files, resulting in suspicious file creation events.

This analytic identifies potential data exfiltration risks by monitoring AWS CloudTrail logs for 'PutBucketAcl' events that grant public access to S3 buckets using the AWS CLI.

An argument injection vulnerability in the ILIAS assImagemapQuestionGUI component allows authenticated question authors to achieve remote code execution by injecting ImageMagick options via crafted filenames.

mJobTime builds through 15.7.3.32 contain an unauthenticated SQL injection vulnerability in Login.aspx allowing attackers to execute arbitrary commands as LocalSystem via xp_cmdshell.

Grid Protection Alliance openPDC and openHistorian contain multiple critical vulnerabilities, including insecure deserialization and missing authentication, allowing unauthenticated remote attackers to execute code, exfiltrate system data, or manipulate data streams.

Satel Netco Design versions prior to v2.1.7 contain multiple vulnerabilities, including path traversal, XSS, and regex-based DoS, which could be chained by an authenticated user for unauthorized file modification and remote code execution.

Multiple high and critical severity vulnerabilities in Red Lion Controls N-Tron 700 series switches, including hard-coded credentials and improper authentication, allow for unauthorized administrative access, configuration theft, and denial-of-service.