THREAT OPS › Threat News

Threat Intelligence News

11897 reports from 110+ open cyber-threat-intelligence sources — APT activity, malware, vulnerabilities and campaigns, newest first.

[GHSA] GHSA-jj27-h5hq-8x99 (high) — Angular i18n: Cross-Site Scripting (XSS) via event-handler attributesgithub_advisories · 2026-08-03
[NVD] CVE-2026-18651 (MEDIUM 5.4) — A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the alrnvd · 2026-08-03
[NVD] CVE-2026-18248 (CRITICAL 9.1) — @fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the default configuration, thenvd · 2026-08-03
INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flawsthehackernews · 2026-08-03
[GHSA] GHSA-vpx6-8pjr-4g3v (high) — Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)github_advisories · 2026-08-03
Zero-Day Remediation Meets Operational Resiliencyqualys · 2026-08-03
[Webinar] Tales from the Frontlines: An exclusive briefing on Q2 incidentstalos · 2026-08-03
ConfigManBearPig 2.0 – Things Are Getting Cerealspecterops · 2026-08-03
LLM Heist: Hijacking LiteLLM for Traffic Interception, Key Theft, and Tool-Call Injectionembracethered · 2026-08-03
[GHSA] GHSA-jhpw-976m-542j (high) — Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoninggithub_advisories · 2026-08-03
Agent Val Now Validates the Entire Attack Surface: From Network to Hostqualys · 2026-08-03
How TTEC Turned Hidden Attack Paths Into Audit-Ready Security Validationhorizon3 · 2026-08-03
[GHSA] GHSA-m65r-rprj-r5rg (medium) — Russh: Channel-scoped server callbacks can be reached without an open channelgithub_advisories · 2026-08-03
CVE-2026-61372: Apache Jena Fuseki: Web requests using SPARQL Update can escape file restrictionsoss_sec · 2026-08-03
Re: RefluXFS: LPE in the Linux kernel via XFS reflink race (CVE-2026-64600)oss_sec · 2026-08-03
Re: Some Changes to GNOME Security Trackingoss_sec · 2026-08-03
mpg123 release 1.33.7 with lots of security-relevant fixesoss_sec · 2026-08-03
Analysis of the Connection Between Xctdoor and Past CRAT Attack Cases (Larva-26005)ahnlab · 2026-08-03
Metasploit Pro 5.1 Releasedrapid7 · 2026-08-03
Dark Web Profile: Mustang Pandasocradar_blog · 2026-08-03
⚡ Weekly Recap: Rogue AI Models, $88M Bitcoin Theft, Water-System Attacks and Dangling DNS Hijacksthehackernews · 2026-08-03
The Assets You Don’t Know You Own: Attack Surface Sprawl Is a Discovery Problem, Not a Tooling Problemcyble · 2026-08-03
[qilin] Service Electric posted to leak siteransomware_live · 2026-08-03
3rd August – Threat Intelligence Reportcheckpoint_research · 2026-08-03
Horizon3 Raises $250M Series E at $2B+ Valuation to Lead the “AI vs. AI” Cybersecurity Erahorizon3 · 2026-08-03
An analysis of incidents at Brazilian educational institutionssecurelist · 2026-08-03
Introducing Agent Intent-Based Access Controlvaronis_blog · 2026-08-03
[akira] Albers Mechanical Contractors posted to leak siteransomware_live · 2026-08-03
Introducing AI AppGen Security to Protect the New Generation of AI Buildersorca_security · 2026-08-03
Say Hello to Agent Insta: Closing the Detection Gap in Exposure Management at Machine Speedqualys · 2026-08-03
CVE-2026-48449: Adobe Campaign Classic RCEsocradar_blog · 2026-08-03
[akira] Belasco Electric posted to leak siteransomware_live · 2026-08-03
CISA Adds One Known Exploited Vulnerability to Catalogcisa_advisories · 2026-08-03
FOMO in the SOC: Where AI Platforms like Claude Actually Fitthehackernews · 2026-08-03
Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOSthehackernews · 2026-08-03
The OpenAI Hack Shows the Genie Is Out of the Bottleschneier · 2026-08-03
Introducing DOUBLECUP, a ClickFix Loader Delivering CountLoader and DeviceManager RATssocradar_blog · 2026-08-03
Pass the Passkey: A Novel Attack Surface in Passwordless Authenticationunit42 · 2026-08-03
30 days with Claude Mythos Preview: How Tenable adapted our security program, and why yours is nexttenable · 2026-08-03
PNLD Breach Exposes U.K. Police and Government Contact Details on Dark Webthehackernews · 2026-08-03
CVE Exploit Sale, Pakistan Telecom Data Claim, WineStyle Leak, RDWeb Access, and Moscow Health Database Salesocradar_blog · 2026-08-03
Thermo Fisher Patches Flaw That Could Make DNA File Tampering Nearly Undetectablethehackernews · 2026-08-03
Rapid7 Expands UK and Ireland Channel Presence Through Strategic Partnership with Exclusive Networksrapid7 · 2026-08-03
[NVD] CVE-2026-12965 (CRITICAL 9.1) — The Super Store Finder WordPress plugin before 7.11 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection and extract data from the database.nvd · 2026-08-03
A week in security (July 27 – August 2)malwarebytes_blog · 2026-08-03
[dragonforce] TUI China posted to leak siteransomware_live · 2026-08-03
N-able Says Attackers Take Over N-central Servers After Initial Fix Proves Incompletethehackernews · 2026-08-03
Hugging Face Diffusers Flaws Could Let Model Repositories Execute Arbitrary Codethehackernews · 2026-08-03
Zero Trust Branch Is Now Available in FedRAMP Moderate and Highzscaler_threatlabz · 2026-08-03
[payload] Hans & Jos. Kronenberg GmbH posted to leak siteransomware_live · 2026-08-03
[NVD] CVE-2026-14682 (HIGH 7.5) — In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length read. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X seriesnvd · 2026-08-03
[NVD] CVE-2026-13586 (HIGH 7.5) — In Bouncy Castle for Java before 1.85, PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS). This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3nvd · 2026-08-03
[NVD] CVE-2026-13506 (HIGH 7.5) — In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X nvd · 2026-08-03
[qilin] Freedom Claims Management posted to leak siteransomware_live · 2026-08-03
Risky Bulletin: Anthropic models also did the hacky-hackyriskybiz_news · 2026-08-03
[NVD] CVE-2026-20472 (MEDIUM 4.4) — In TFA, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10991467; Issue ID: MSV-7764.nvd · 2026-08-03
[NVD] CVE-2026-20471 (MEDIUM 4.6) — In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: Anvd · 2026-08-03
[NVD] CVE-2026-20470 (MEDIUM 6.2) — In Telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11086431; Issue ID: MSV-8189.nvd · 2026-08-03
[NVD] CVE-2026-20469 (MEDIUM 6.0) — In trusted_mem, there is a possible escalation of privilege due to improper input validation. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is needed for exploitation. Patch ID: AUTO00834868; Issunvd · 2026-08-03
[NVD] CVE-2026-20468 — In apusys, there is a possible escalation of privilege due to a confused deputy. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: AUTO00833804; Issue ID: MSVnvd · 2026-08-03
[NVD] CVE-2026-20467 — In apusys, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: AUTO00837766; Issue IDnvd · 2026-08-03
[NVD] CVE-2026-20466 — In sec boot, there is a possible escalation of privilege due to a heap buffer overflow. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitatnvd · 2026-08-03
[NVD] CVE-2026-20465 — In wlan AP driver, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00489200nvd · 2026-08-03
[NVD] CVE-2026-20464 — In hevc decoder, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11104718; Issue IDnvd · 2026-08-03
[NVD] CVE-2026-18582 (MEDIUM 5.3) — A security flaw has been discovered in mz-automation libiec61850 up to 1.6.1. This vulnerability affects the function Reporting_RCBWriteAccessHandler of the file src/iec61850/server/mms_mapping/reporting.c of the component Report Sending Path Handler. The manipulation results in nvd · 2026-08-03
Re: Some Changes to GNOME Security Trackingoss_sec · 2026-08-03
[NVD] CVE-2026-8763 — In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3nvd · 2026-08-03
[NVD] CVE-2026-59649 — In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series)nvd · 2026-08-03
[NVD] CVE-2026-59648 — In Bouncy Castle for Java before 1.85, OpenPGP Argon2 S2K honours attacker-chosen memory and passes. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.1nvd · 2026-08-03
[NVD] CVE-2026-59647 — In Bouncy Castle for Java before 1.85, CRMF/CMP password-MAC honours unbounded iteration count. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (nvd · 2026-08-03
[NVD] CVE-2026-59646 — In Bouncy Castle for Java before 1.85, DTLS handshake reassembler allocates buffer from unchecked 24-bit length. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bctls-fips 1.0.24 (1.0.X series), 2.0.24 (2.0.X serinvd · 2026-08-03
[NVD] CVE-2026-59645 — In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcutil-fips 2.0.7 (2.0.X series) and 2.1.7 (2.nvd · 2026-08-03
[NVD] CVE-2026-59642 — In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X seriesnvd · 2026-08-03
[NVD] CVE-2026-59641 — In Bouncy Castle for Java before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcmail-fips and bcjmail-fips 1.0.7 (1.0.X series), 2.nvd · 2026-08-03
[NVD] CVE-2026-59640 — In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check oracle active on symmetric/session-key paths. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) anvd · 2026-08-03
[NVD] CVE-2026-59639 — In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) anvd · 2026-08-03
[NVD] CVE-2026-59638 — In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bctls-fips 1.0.24 (1.0.X series), 2.0.24 (2.0nvd · 2026-08-03
[NVD] CVE-2026-18581 (LOW 3.3) — A vulnerability was determined in ggml-org llama.cpp e15efe0. Affected by this issue is some unknown functionality of the file common/jinja/parser.cpp of the component Jinja Minja Template Parser. Executing a manipulation with the input {{9|9|{ can lead to reachable assertion. Thnvd · 2026-08-03
[NVD] CVE-2026-15055 — In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2nvd · 2026-08-03
Microsoft Edge Multiple Vulnerabilitieshkcert · 2026-08-03
RedHat Linux Kernel Multiple Vulnerabilitieshkcert · 2026-08-03
Ubuntu Linux Kernel Multiple Vulnerabilitieshkcert · 2026-08-03
PHP Multiple Vulnerabilitieshkcert · 2026-08-03
Sponsored: The intrusion signals hiding in plain sightriskybiz_news · 2026-08-03
Benchmarking the Agentic SOC: How we evaluate LLMs for security workflowselastic_security · 2026-08-03
SOC case management and detection rule history in Elastic Securityelastic_security · 2026-08-03
8 Ways AI is Changing Threat Intelligencerecordedfuture · 2026-08-03
[Breach] Chess.com (2026) — 4,653,212 accounts exposedhibp_breaches · 2026-08-03
[CISA KEV] CVE-2026-18577 — N-able N-central: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerabilitycisa_kev · 2026-08-03
[krybit] www.prohealth.sg posted to leak siteransomware_live · 2026-08-02
[incransom] ecfa.org posted to leak siteransomware_live · 2026-08-02
Re: Some Changes to GNOME Security Trackingoss_sec · 2026-08-02
[qilin] INTERTRUST AUSTRALIA PTY LTD posted to leak siteransomware_live · 2026-08-02
[qilin] Asset Flooring Group Australia posted to leak siteransomware_live · 2026-08-02
[NVD] CVE-2026-10848 (HIGH 7.0) — The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parse_rpc_msg() (subsys/net/lib/ocpp/ocpp_j.c) using a hand-rolled helper, extract_string_field(), that copied the message's uid and action fields with strncpy(out_buf, token + 1, outlen - 1) and then scnvd · 2026-08-02
[qilin] Mairie de Drancy posted to leak siteransomware_live · 2026-08-02
[NVD] CVE-2026-9856 (HIGH 7.1) — A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the `save_pretrained()` methods of `PreTrainedTokenizerBase` and `ProcessorMixin`, where keys from the `chat_template` dinvd · 2026-08-02
Re: Some Changes to GNOME Security Trackingoss_sec · 2026-08-02
[NVD] CVE-2026-65321 (CRITICAL 9.8) — PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping in DefaultParameterFormatter.format(), which routes DELETE and CTAS statements to the _escape_hive function that bacnvd · 2026-08-02
[NVD] CVE-2026-10774 (LOW 2.4) — Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-key teardown. In subsys/bluetooth/mesh/subnet.c, net_keys_create() imports the Private Beacon Key into a PSA key slot under CONFIG_BT_MESH_PRIV_BEACONS (enabled by default), but subnet_keynvd · 2026-08-02