← Feed

Posts

• View post

  Two critical PHP core vulnerabilities enable pre-application RCE with CVSS 9.2. Cloudflare and Amazon confirm active exploitation. When the engine itself is compromised, https://deafnews.it/en/article/php2shell-when-the-engine-becomes-the-target-every-downstream-defense-fails

• View post

  Qualys details BlueHammer (CVE-2026-33825), an eight-stage Windows Defender privilege escalation chain reaching SYSTEM. Same version, different risk: why version https://deafnews.it/en/article/bluehammer-shatters-version-scanning-the-same-defender-can-be-harmless-or-fatal

• View post

  APT41 deploys BlackX UEFI bootkit against Central Asian diplomatic targets in Tajikistan, Uzbekistan and Turkmenistan, using a non-CVE Secure Boot bypass dubbed https://deafnews.it/en/article/apt41-adopts-blacklotus-techniques-blackx-uefi-bootkit-hits-central-asian-diplomats

• View post

  Imperva researchers achieved full remote code execution on an unmodified Node.js Linux arm64 build using crafted Brotli data, moving beyond prior https://deafnews.it/en/article/node2shell-from-compressed-format-to-rce-on-nodejs-demonstrated-on-official-linux-arm64-build

• View post

  OpenSSL CMP format string bug CVE-2026-63073 lets unauthenticated remote attackers crash PKI clients with sender or pinned cert validation. Disclosed after six months of https://deafnews.it/en/article/openssl-cmp-format-string-bug-cve-2026-63073-exposes-pki-clients-to-crash

• View post

  Zimbra CVE-2026-73570: Unauthenticated RCE was actively exploited via Swatchdog log injection for over two weeks before patch disclosure, Microsoft reports. #Cybersecurity #InfoSec https://deafnews.it/en/article/zimbra-cve-2026-73570-unauthenticated-rce-exploited-before-patch

• View post

  Snort 3's VBA inspection engine has a critical flaw: ZDI-26-788/CVE-2026-20218 is a stack-based buffer overflow rated 8.1 RCE, though Cisco calls it DoS. Independent RCE https://deafnews.it/en/article/snort-3-bug-when-the-vba-inspection-engine-becomes-an-attack-vector

• View post

  NVIDIA Megatron Bridge has a HIGH-severity YAML parsing RCE (ZDI-26-787), but there's a catch: the CVE says no user interaction needed, while ZDI says otherwise. We break https://deafnews.it/en/article/nvidia-megatron-bridge-user-interaction-rce-in-model-config-yaml-parsing

• View post

  Critical CVSS 9.8 flaw in Splunk Enterprise's Patroni REST API allows unauthenticated remote code execution for attackers with internal network access. No credentials https://deafnews.it/en/article/cve-2026-76268-unauthenticated-rce-in-splunk-enterprise-patroni-rest-api

• View post

  A critical 12-year-old RCE flaw in Pillow, Python's most popular imaging library, let attackers inject commands through filenames passed to Ghostscript. CVSS 4.0 score: 9.2. Fixed in https://deafnews.it/en/article/pillow-1300-fixes-rce-the-filename-not-the-file-was-the-threat

• View post

  BeyondTrust disclosed a critical Remote Support flaw after Chinese APT Armory Castle exploited it as a zero-day for 47 days, using Sawfly web shell and Bareclaw SOCKS5 tunnel for https://deafnews.it/en/article/beyondtrust-chinese-apt-armory-castle-exploited-zero-day-for-47-days

• View post

  Qualys releases detection tools for compromised eMudhra certificates after eight intermediate CAs were hit by CVE-2026-111943 and CVE-2026-111944, with P-384 keys https://deafnews.it/en/article/emudhra-8-intermediate-cas-compromised-qualys-releases-operational-detection-tools

• View post

  PHP discloses another unpatched RCE flaw just two days after the PHP2Shell emergency, assigning CVE-2026-115560. Same mitigation applies. https://deafnews.it/en/article/php-discloses-new-unpatched-rce-flaw-two-days-after-php2shell-emergency #Cybersecurity #InfoSec

• View post

  TrendAI ZDI discloses zero-day deserialization flaw in Genesis World enabling remote code execution. No patch available yet. #Cybersecurity #InfoSec https://deafnews.it/en/article/zero-day-rce-in-genesis-world-zdi-publishes-advisory-with-no-patch-available

• View post

  FBI arrests Edward Dubrovsky, a ransomware negotiator, on extortion conspiracy charges in Pennsylvania. The case raises new questions about oversight of the ransomware response industry. https://deafnews.it/en/article/fbi-arrests-ransomware-negotiator-industry-under-scrutiny

• View post

  471 million breach notices sent in H1 2026, yet just 24% disclose how the attack happened. The lowest transparency rate on record leaves Americans with alerts they cannot act on. https://deafnews.it/en/article/471-million-breach-notices-but-only-24-say-how-it-happened

• View post

  Ransomware gangs are increasingly targeting people, not just systems. A new survey finds 37% of attacks now involve direct threats against staff, including photos of https://deafnews.it/en/article/ransomware-gets-personal-37-of-attacks-now-include-direct-threats-against-staff

• View post

  SAP patched a critical SSRF vulnerability (CVE-2026-89111, CVSS 10.0) in its Cloud SDK for Python. Unauthenticated attackers can steal OAuth2 client credentials from https://deafnews.it/en/article/cve-2026-89111-critical-ssrf-in-sap-cloud-sdk-for-python-exfiltrates-credentials

• View post

  Google and Mozilla patched 114 vulnerabilities in Chrome 155 and Firefox 158. Mozilla also launched Firefox Enterprise for organizations with strict security and https://deafnews.it/en/article/chrome-and-firefox-114-vulnerabilities-patched-as-mozilla-launches-firefox-enterprise

• View post

  Tencent's Corvus AI found Linux kernel vulnerability Vghost (CVE-2026-74580) in two hours, enabling root privilege escalation and potential guest-to-host escape in virtualized https://deafnews.it/en/article/vghost-tencents-ai-finds-linux-kernel-vhost-flaw-in-two-hours

• View post

  XBOW used GPT-5.6 Sol to build a full-chain Chrome exploit in six days for $40,000 in compute. Google paid the maximum $250,000 bounty. #AI #Cybersecurity https://deafnews.it/en/article/from-six-months-to-six-days-gpt-56-sol-built-the-250000-chrome-exploit

• View post

  Hirudo represents a major evolution in Android banking malware: instead of overlays, it fully replaces targeted apps with patched copies that bypass https://deafnews.it/en/article/hirudo-the-trojan-that-deceives-banking-apps-from-within-by-replacing-them-with-patched-copies

• View post

  Researchers uncover ROMULUS, a ClickFix platform distributing malware across six servers. The operation highlights evolving delivery tactics in the threat landscape. https://deafnews.it/en/article/romulus-the-clickfix-platform-delivering-malware-across-six-servers

• View post

  Critical unauthenticated SQL injection vulnerability (CVSS 9.8) discovered in WebAlliance B2B e-commerce platform. Flaw enables sensitive data exposure and https://deafnews.it/en/article/cve-2026-108065-critical-pre-auth-sql-injection-in-weballiance-b2b-e-commerce-platform

• View post

  UK sanctions Cryptomus for laundering Russian funds, 14 months after Canada's record $177M FINTRAC fine. The crypto service simply rebranded to Heleket and kept operating. First https://deafnews.it/en/article/uk-sanctions-cryptomus-canadas-176m-fine-failed-to-stop-the-operation

• View post

  Two vulnerabilities in AhsayCBS allow attackers to achieve SYSTEM-level remote code execution via a manipulated JSON flag. Active exploitation with cryptominers reported since October https://deafnews.it/en/article/ahsaycbs-under-attack-from-a-java-boolean-to-system-level-rce

• View post

  Cisco patches two actively exploited zero-days in Secure Email Gateway, allowing unauthenticated remote root access via malicious email attachments. One added to CISA's KEV catalog. https://deafnews.it/en/article/cisco-seg-under-siege-third-zero-day-in-a-year-root-via-email

• View post

  A Microsoft code regression allows remote attackers to crash Windows Server with a single malformed DFS packet. No authentication required. #Cybersecurity https://deafnews.it/en/article/microsoft-code-regression-exposes-windows-server-to-remote-crash-via-dfs-packet

• View post

  CenterPoint Energy breach exposes data of 1 million Texans including SSNs and driver's licenses. Texas AG confirms no customer notice was issued at time of report. https://deafnews.it/en/article/centerpoint-data-of-1-million-texans-exposed-no-customer-notice-issued

• View post

  Palo Alto Networks Unit 42 uncovers PEERSTITCH, a memory-resident ARM64 malware that transforms FortiGate firewalls into stealth espionage platforms by hiding inside legitimate https://deafnews.it/en/article/peerstitch-malware-turns-fortigate-firewalls-into-espionage-platforms