Posts on Security, Cloud, DevOps, Citrix, VMware and others.
Words and views are my own and do not reflect on my companies views.
Disclaimer: some of the links on this site are affiliate links, if you click on them and make a purchase, I make a commission.
Cybersecurity researchers have sounded an alert after finding more than 36,000 Baseboard Management Controller (BMC) management interfaces exposing Intelligent Platform Management Interface (IPMI) protocol to the public internet.
Of the 36,872 internet-exposed server-management interfaces running IPMI, 24,650 have been found to disclose password-derived authentication hashes before login due to a vulnerability with the IPMI v2.0 specification itself, according to a new report Lava shared with The Hacker News. IPMI v2.0 was introduced in February 2024.
The issue in question is CVE-2013-4786 (CVSS score: 7.5), a high-severity information disclosure flaw that enables remote attackers to obtain password hashes for valid accounts and conduct offline password guessing attacks by obtaining the HMAC from an RMCP+ Authenticated Key-Exchange Protocol (RAKP) message response from a BMC.
Per an advisory released by Dell, "this is an inherent problem with the specification for IPMI v2.0," with the PC maker noting that there is no patch.
"More than 30% of the returned hashes were associated with passwords that could be recovered using common wordlists and predictable factory chassis-sticker formats," security researcher Michael Katchinskiy said. "The exposure also affected modern Supermicro and HPE servers operated by GPU providers, including systems that were still using factory-issued passwords."
BMCs are specialized management processors embedded on a server's motherboard that control power, firmware, remote console access, operating system installation, and system recovery. They also act as a crucial component for remote data center automation and uptime to monitor hardware telemetry and facilitate mass deployment of firmware updates and BIOS configurations.
To bridge remote commands to the hardware, the BMC typically communicates using protocols like IPMI and Redfish. As highlighted by firmware security company Eclypsium in late 2022 and early 2023, the privileged position enjoyed by BMCs can also make them ideal attack targets for bad actors looking to gain remote control and deploy persistent malware.
Because BMCs run completely independently of the host operating system, a mechanism known as Out-of-Band (OOB) management, an attacker who manages to successfully compromise an exposed BMC can sidestep traditional security controls, survive operating system reinstalls, and maintain access.
"In modern AI data centers, where the same bare-metal environment often hosts multiple tenants, a single exposed BMC can potentially place multiple organizations' workloads at risk through shared infrastructure or lateral movement, making this a significant blind spot in the infrastructure underpinning the AI data center boom," the Israeli company said.
At the heart of the research is CVE-2013-4786, a 20-year-old weakness in IPMI 2.0, which an attacker can exploit to recover weak, reused, factory-set, or predictably formatted passwords.
"During the authentication process, the BMC can return a message response containing an HMAC-SHA1 authentication code calculated using the account password and session values known to the requester," Katchinskiy explained. "An unauthenticated remote party that can reach UDP port 623 can request this response and test password guesses offline. Unlike repeated online login attempts, the offline process does not require a new request to the BMC for every password candidate."
As of May 6, 2026, a search of the public internet for IPMI services exposed on UDP port 623 uncovered 36,872 unique hosts, of which more than 14,000 are located in the U.S. The remaining systems are concentrated in Germany, China, the Netherlands, and the U.K.
Further analysis has determined that nearly 25,000 exposed password-derived authentication materials before login, allowing offline credential cracking. Perhaps even more concerningly, a total of 6,240 BMCs returned authentication material for an empty username that matched a weak password candidate and another 2,340 BMCs returned authentication data for a named account such as ADMIN or root that matched a password from publicly available wordlists.
In tests conducted by Lava, HPE iLO factory passwords were recoverable within a minute using modern GPU hardware, while Supermicro factory passwords were recoverable in approximately one hour despite being uniquely assigned to each server. In response to the findings, Supermicro said it will evaluate possible improvements to the default password policy for future hardware revisions.
"CVE-2013-4786 is not new, but the risk around it has changed," Lava said. GPU cracking has made offline password recovery faster, while modern AI and bare-metal environments have made each exposed server more valuable.
On top of that, evidence has emerged that threat actors are already targeting internet-exposed BMC interfaces, including ransomware operators leaving an extortion note on an HPE iLO 4 login page. It's not clear who is behind the activity. That said, HPE iLO servers have been singled out as far back as 2020 to deploy a rootkit called iLOBleed.
To counter the risk, it's advised to block UDP port 623 at the network edge, rotate factory-issued passwords during provisioning, disable legacy or weak options such as IPMI 1.5, restrict BMC access to a dedicated private management network, and apply network access controls to ensure only approved administrative systems can reach BMC interfaces.
"Organizations have spent years hardening cloud workloads and operating systems, but many have overlooked the infrastructure that sits beneath them," said Yakir Kadkoda, CTO and co-founder at Lava, in a statement.
"These management controllers hold the keys to servers and data centers. Once compromised, attackers can operate below the visibility of almost any security tools, maintain persistence even after systems are rebuilt, and potentially move deeper into critical infrastructure. As AI infrastructure rapidly expands, securing this layer has become far more urgent."
from The Hacker News https://ift.tt/sqTcgrX
via IFTTT
The Iranian state-backed hacking group tracked as Nimbus Manticore (aka GalaxyGato, Mirage Kitten, Smoke Sandstorm, Subtle Snail, and UNC1549) has been attributed to a fresh set of attacks targeting entities across the Middle East, Africa, and South Asia.
The intrusions involve the use of a previously undocumented Windows backdoor called NightLedger and two custom WebSocket tunnelers, BridgeHead and ArcBridge, with an aim to maintain covert access.
Targets of the campaign include Egypt, SMB and government environments in Jordan and Tanzania, aviation organizations in Pakistan, telecommunication companies in Ethiopia, and financial-sector entities in Burkina Faso, per Kaspersky.
"The toolset includes NightLedger, a new Windows backdoor for reconnaissance, command execution, file operations, process discovery, and screenshot capture; and two custom WebSocket-based tunnelers, ArcBridge and BridgeHead, for covert network access and operator-controlled tunneling," Kaspersky researchers Omar Amin and Vasily Berdnikov said.
The exact initial access method used in the attacks is presently unknown, although the adversary is known to employ highly tailored job opportunity-themed phishing lures masquerading as trusted brands and hiring platforms, as well as lookalike videoconferencing pages, to redirect recipients to malicious archives hosted on third-party file-sharing services.
The as-yet-undetermined access route is then abused to deliver the malicious payloads, including NightLedger, which is launched as a DLL via DLL side-loading. The malware is designed to contact an external server over HTTPS to parse and run commands in a manner that's analogous to TWOSTROKE, another backdoor deployed by the threat actor in the past. The list of supported commands is below -
Gather user and host identity information
Execute a process/program
List directories
Download a file to the infected system
Collect host and network information
Copy or delete files
Update beacon interval
Take a screenshot
Load a DLL
Terminate a process or thread
Upload file to the command-and-control (C2) server via an HTTP POST request
Enumerate logical drives
List processes
Collect C:\Windows\debug\NetSetup.log (a diagnostic file used for troubleshooting domain join issues) together with process-list output
Two other malware families delivered as part of the attacks are BridgeHead ("unbcl.dll"), a SOCKS5 tunnel proxy observed in environments in Egypt and Pakistan that shares some level of functional overlaps with MiniFast (aka MiniUpdate and Retrograde), and ArcBridge, another WebSocket tunneling tool observed in April 2026 in activity targeting victims in the Middle East.
"The C2 server initiates all tunnel connections by sending binary commands over the WebSocket; the implant simply forwards traffic between server-specified targets and the WebSocket channel," the researchers said about BridgeHead. "This makes it a relay node: the operator runs tools server-side, and all resulting TCP traffic is tunneled through the victim's machine as if originating from the victim's network."
The use of BridgeHead and ArcBridge indicates the threat actor's continued use of tunneling utilities, which has been previously observed relying on bespoke tunnelers such as LIGHTRAIL and POLLBLEND.
The disclosure comes days after Group-IB uncovered a new malware sample codenamed HOLLOWGRAPH that's linked to the Cavern (aka Cav3rn) framework used by an Iranian hacking crew dubbed Cavern Manticore.
"HOLLOWGRAPH abuses Microsoft Graph API to transform a compromised Microsoft 365 calendar into a covert two-way command-and-control channel," it said.
"Using the Microsoft Graph API, it treats the compromised mailbox's calendar as a two-way dead-drop: operators plant tasking as calendar events, and the implant exfiltrates stolen files by creating its own events with encrypted data attached. To avoid catching the mailbox owner's attention, every event is dated far into the future - 13 May 2050 - with payloads attached as files to the event."
from The Hacker News https://ift.tt/VyIlRGx
via IFTTT
When you manage an IT infrastructure, few tasks are as critical yet as routinely underestimated as patching. Whether you’re running a small business with a handful of Linux servers and Windows machines or an enterprise with hundreds of nodes across multiple distributions, keeping systems up to date is non-negotiable. Unpatched systems are low-hanging fruit for attackers, and compliance requirements like CIS benchmarks only add to the pressure.
I’ve spent years working with VMware, Microsoft, and various Linux setups, writing about upgrades, security patches, and keeping environments stable. The challenges haven’t changed much: SSH marathons, inconsistent scripts, forgotten hosts, and auditors asking for evidence that takes days to compile. Tools like PatchMon are here to help and to change that by providing unified visibility and management for Linux, FreeBSD, and Windows fleets.
Default overview of PatchMon dashboard – screenshot from Patchmon.net
The Patching Reality Check
Let’s be honest. Patch Tuesday (or its Linux equivalents) often turns into chaos. You have Ubuntu servers using APT, RHEL/AlmaLinux with DNF, Alpine with APK, Arch with Pacman, FreeBSD pkg, and Windows Update – all needing attention. PatchMon has Six package mangers within the dashboard to help you. In small businesses, one or two admins juggle this alongside everything else. In enterprises, it scales to dozens or hundreds of nodes, with different teams, maintenance windows, and risk profiles.
The consequences of falling behind are severe. Exploits targeting known vulnerabilities spread fast. We’ve seen major incidents where a single unpatched system became the entry point for ransomware or data breaches. Security isn’t just about firewalls and antivirus anymore – it’s fundamentally about reducing the attack surface through timely updates.
Beyond security, there’s compliance. Standards like CIS Benchmarks, SOC 2, ISO 27001, or industry-specific regulations demand proof that you’re managing vulnerabilities systematically. Manual processes make this painful. Spreadsheets get out of date quickly, and “I think we patched it” doesn’t satisfy auditors.
Why Patching Matters More Than Ever
Security and Exploits: Most breaches exploit known vulnerabilities with available patches. Delaying updates means living with unnecessary risk. Critical security updates often address remote code execution, privilege escalation, or denial-of-service flaws. In a mixed environment, one weak Linux node can compromise the whole network.
Operational Stability: Patching isn’t just “apply and forget.” Poorly tested updates can break applications or cause downtime. That’s why dry-run capabilities, scheduling, and approval workflows are essential. Tools that let you preview changes reduce surprises.
Compliance and Audit Readiness: CIS benchmarks cover everything from file permissions and service configurations to network settings. Running OpenSCAP scans manually across fleets is time-consuming. Automated scanning with historical tracking turns compliance from a quarterly fire drill into ongoing visibility.
Screenshot from PatchMon.net site
Resource Efficiency: Admins shouldn’t spend Mondays doing patch reconnaissance tours. Time saved on patching can go toward strategic work like infrastructure optimization or new projects.
For small businesses, this means fewer nights worrying about security. For enterprises, it means better control, consistent policies, and reduced mean time to patch.
Introducing PatchMon: Unified Patch Management
PatchMon is an open-source (AGPL v3) platform designed specifically for mixed environments. It provides a single dashboard for Linux, FreeBSD, and Windows visibility, with patching capabilities focused on Linux/FreeBSD today (Windows deployment is on the roadmap). Over 55K servers reportedly run it, with a growing community.
Screenshot from PatchMon.net site
Key Capabilities:
Multi-Package Manager Support: Automatic detection and reporting for APT, DNF/YUM, APK, Pacman, FreeBSD pkg, and Windows Update. One view show pending updates across everything, with security flagging.
Patch Policies and Scheduling: Define policies for immediate application, delayed rollout, or fixed maintenance windows. Assign to host groups with exclusions for special cases. Timezone support helps global teams.
Dry-Run and Approval Workflows: Preview exactly what will change before touching production. Approval gates for critical systems, with full audit trails including who approved what and shell output.
Compliance Scanning: Integrated OpenSCAP for CIS benchmarks and Docker Bench. Rule-level results, severity ratings, remediation guidance, and trend tracking over time. This is gold for auditors—generate reports in minutes.
Additional Features: Browser-based SSH/RDP (outbound agent connections, no exposed ports or VPN needed), Docker inventory and security scanning, alerting to Slack/Discord/etc., RBAC with SSO, and integrations with Proxmox, Ansible, and more.
Deployment is straightforward: Cloud option for quick start or self-hosted Community Edition. Lightweight agents use outbound connections only, which is a security win – no inbound firewall holes required.
Real-World Benefits for Small Businesses and Enterprises
For Small Businesses: With limited staff, PatchMon replaces ad-hoc scripts and manual checks with a clean dashboard. Install the agent with a one-liner, and you immediately see your patch status. Scheduling prevents “I forgot to update that test server” scenarios. Compliance becomes manageable even without a dedicated security person.
For Enterprises: Scale matters. Centralized visibility across heterogeneous fleets, policy enforcement, audit trails for SOC 2/ISO, and integration into existing workflows (Ansible inventories, webhooks, REST API). High-availability options and PRO support for large deployments address enterprise needs. Air-gapped and custom deployments are possible.
In my experience with VMware and Microsoft environments, unified tools reduce “patch drift” – where some nodes lag behind. PatchMon helps maintain consistency, which is crucial in virtualized or containerized setups where one vulnerable host can affect others.
Best Practices for Effective Patching
Regardless of the tool, follow these principles:
Inventory Everything: Know every node, its OS/distribution, and role. PatchMon’s discovery helps here.
Prioritize: Focus on security updates first. Separate critical from nice-to-have.
Test Before Deploy: Use staging environments or dry-runs. Monitor for regressions post-patch.
Schedule Smartly: Align with maintenance windows. Automate where possible but keep human oversight for production.
Document and Audit: Every change should be traceable. Automated trails beat manual logs.
Monitor Compliance Continuously: Don’t wait for audit time. Track CIS scores over time and remediate systematically.
Combine Tools: PatchMon integrates well with configuration management like Ansible. Use it alongside your existing stack rather than replacing everything.
Potential Considerations
Like any tool, evaluate fit. Test it. Self-hosted which is available at Github, gives full control but requires maintenance of the platform itself. Cloud simplifies operations. Windows patching visibility is strong now, but full deployment is upcoming—factor that in if Windows is dominant. As with any agent-based solution, review security implications and test in your environment.
The open-source nature allows code auditing and community contributions, which is a plus for transparency-focused teams.
Final Words
Take Control of Your Patch Posture. Patching isn’t glamorous, but it’s foundational to security, compliance, and reliability. In today’s threat landscape, with exploits targeting everything from kernels to container runtimes, staying up-to-date on every managed node is essential. Tools that eliminate spreadsheets, reduce SSH fatigue, and generate audit-ready evidence deliver real ROI.
PatchMon stands out by focusing on the mixed Linux/FreeBSD/Windows reality many of us face, with strong emphasis on visibility, safe deployment practices, and compliance. Whether you’re a small team tired of manual processes or an enterprise seeking better control, it’s worth exploring – especially the self-hosted option for those who prefer owning their infrastructure. This is a good plan. Enjoy. Please note that the tool is evolving. For example the Windows patching was added only recently, and IMHO, it was a goo plan.
FAQ
How often should business systems be patched?
Critical security patches should be assessed and deployed as soon as practical. Other updates can follow a regular monthly maintenance cycle.
Do software patches always require downtime?
No. Many updates can be installed without interruption, but kernel, driver, and core system patches may require a reboot.
Which patches should be prioritized?
Prioritize actively exploited vulnerabilities, internet-facing systems, critical business services, and updates with high severity ratings.
How can teams verify that patching was successful?
Check installation results, reboot status, service health, application logs, and vulnerability scan results after deployment.
from StarWind Blog https://ift.tt/l25N04F
via IFTTT
Phishing was the primary means of gaining initial access this quarter, appearing in over half of all Cisco Talos Incident Response (Talos IR) engagements – an increase from approximately a third of engagements last quarter. Attackers continued to innovate their delivery methods to evade defenses, deploying QR code-embedded PDFs to bypass traditional email gateways and hosting links on trusted cloud platforms. We also saw a spike in authentication abuse this quarter — observed in 65 percent of engagements compared to 35 percent last quarter — with attackers frequently bypassing or defeating multi-factor authentication (MFA) using adversary-in-the-middle (AitM) proxies, session-token theft, MFA fatigue attacks, and self-enrolled devices, amongst other methods.
Ransomware incidents made up over 20 percent of engagements this quarter, similar to just under 20 percent last quarter. Talos IR responded to Sinobi ransomware for the first time, as well as previously seen variants Nitrogen and Warlock. We observed ransomware operators leveraging legitimate remote monitoring and management (RMM) tools, such as trojanized MeshAgent binary and Zoho Assist, for stealthy access, requiring defenders to prioritize behavior-based monitoring and strict control over administrative binaries.
QR phishing campaign leverages trusted infrastructure to target Australian organizations
Starting in April, we observed a persistent QR code phishing campaign targeting primarily Australian organizations that leverages compromised Microsoft 365 accounts to harvest credentials and propagate the attack via internal contact lists. The campaign, which remained ongoing as of late June 2026, employs auto-generated, victim-tailored PDF documents containing QR codes that direct to adversary-controlled M365 credential harvesting pages. If credentials are successfully captured, the adversary attempts access to the victim’s Microsoft account and conducts various post-compromise actions including creating email inbox rules for defense evasion, leveraging SharePoint to host malicious documents, and sending additional internal and external phishing emails to continue the compromise chain.
We assess with high confidence that the threat actor, who we have dubbed UAT-11764, will almost certainly continue leveraging this QR code phishing operation, using each newly compromised mailbox's contact lists to expand its reach and sustain the campaign's momentum. By weaponizing existing, trusted infrastructure like SharePoint and M365, UAT-11764 can bypass many standard email security gateways. As such, network defenders should implement policies that block or flag emails containing QR codes within PDF attachments, enforce phishing-resistant MFA on M365 accounts, and monitor for suspicious inbox rule creation and anomalous SharePoint file staging as indicators of post-compromise activity.
ARToken platform provides toolkit for Microsoft 365 account compromise
Talos uncovered a phishing-as-a-service (PhaaS) operator platform, ARToken, in an engagement this quarter that is closely linked to the EvilTokens platform. According to our analysis, the ARToken panel exposes 80+ API endpoints for device code phishing, primary refresh token (PRT) persistence, email access, business email compromise (BEC) operations, and SharePoint exfiltration — all accessible to operators through a React-based dashboard. Our investigation into the platform found phishing lures that impersonate trusted vendors and abuse legitimate Microsoft services, allowing attackers to bypass MFA through the OAuth device authorization flow rather than stealing passwords.
ARToken extends beyond a typical phishing kit by providing affiliates with a comprehensive post-compromise toolkit. We observed capabilities including automated token management, persistent access through PRTs, OneDrive and SharePoint administration, geo-dynamic templates, inbox rule manipulation, cross-account keyword monitoring, and collaborative token sharing. We also identified advanced anti-analysis techniques, including layered evasion mechanisms and encrypted client-side payloads, highlighting the increasing sophistication of modern PhaaS platforms and reinforcing the need for organizations to monitor device code authentication, enforce Conditional Access policies, and strengthen defenses against token-based attacks.
Ransomware trends
Ransomware and pre-ransomware incidents made up over 20 percent of engagements this quarter, relatively similar to just under 20 percent last quarter. As previously mentioned, Talos IR responded to Sinobi ransomware for the first time, as well as previously seen variants Nitrogen and Warlock. We observed operators from these groups leveraging tools not previously identified in public reporting, including a trojanized MeshAgent binary and Zoho Assist for remote access.
Sinobi ransomware operators weaponize MeshAgent for covert backdoor access
We responded to a Sinobi ransomware engagement for the first time in April; while this ransomware-as-a-service (RaaS) operation emerged nearly a year ago, there has been minimal public reporting on the actors’ operations.
Notably, we observed the threat actors use a trojanized MeshAgent binary as their primary C2 mechanism during this engagement, a tactic that has not been previously associated with the group in public reporting. MeshAgent is the open-source agent component of the MeshCentral remote management platform. Here, the actor weaponized it into a covert durable backdoor installed as a SYSTEM-level auto-start service, communicating over encrypted WebSocket (WSS) to an attacker-controlled server. This approach allowed the actor to blend malicious traffic with legitimate remote management activity and maintain undetected access for approximately three days before ransomware deployment.
Following C2 establishment, the actor moved laterally through the network using RDP and WinRM, leveraging a service account with a weak, easily cracked password obtained from the domain credential store, ntds.dit. The actor ultimately deployed the ransomware across the entire domain using a malicious Group Policy Object (GPO) logon script. The incident resulted in the encryption of systems with the .SINOBI file extension, alongside observed data exfiltration staging activity conducted via rclone.exe.
Looking forward, Sinobi operators will likely continue weaponizing legitimate tools like MeshAgent because these binaries blend into standard administrative traffic and bypass many traditional signature-based alerts. The use of GPO-based deployment scripts suggests an understanding of enterprise architecture, and operators will likely continue to exploit centralized management features to ensure rapid, domain-wide encryption. Defenders should prioritize monitoring of administrative tools and implement strict application allowlisting to prevent unauthorized binaries from running as services. Further, proactive hunting for unauthorized MeshAgent instances and auditing service account permissions may help in identifying and disrupting Sinobi activity before encryption.
Warlock actors deploy Zoho Assist to attempt remote access without active user sessions
In one engagement, we observed Warlock ransomware operators (also known as Storm-2603) deploying an installer for the RMM tool Zoho Assist Unattended Agent, which is designed to allow administrative remote control of an endpoint without a user logged in. The tool, which we have not previously seen attributed to Warlock, enables the attackers to maintain persistent, stealthy, and unrestricted control, significantly increasing the potential malicious impact of an incident.
While the activity in this particular did not lead to encryption, it was consistent with a successful Warlock ransomware attack Talos observed in May. To counter this threat, organizations must shift from signature-based detection to behavior-based monitoring, focusing on the specific tactics, techniques, and procedures (TTPs) utilized by Storm-2603, such as the abuse of legitimate administrative tools and rapid movement within the network.
Targeting
For the second quarter in a row, health care led as the most targeted industry vertical accounting for 17 percent of all engagements, with public administration and manufacturing following at 14 percent each. A shared characteristic of these top-targeted sectors is a critical lack of downtime tolerance. The vast majority of targeted health care organizations were entities that directly support clinical operations and/or diagnostic services, where service interruption can result in operational and patient-care consequences. Almost all targeted public administration organizations were local governments, which provide essential public services, while the targeted manufacturing entities represented high-value targets within the industrial supply chain, where potential disruptions could create cascading effects across the downstream technology and energy sectors.
Initial access
As mentioned, phishing was the top means of gaining initial access this quarter, accounting for over half of engagements where initial access could be determined — an increase from 35 percent last quarter. Many phishing engagements included MFA-bypass techniques, such as OAuth device-code phishing and AiTM frameworks, allowing adversaries to intercept session tokens. Other observed means of achieving initial access included exploitation of public-facing applications and drive-by compromise.
Recommendations for addressing top security weaknesses
Implement properly configured, phishing-resistant MFA and tighten authentication controls
Authentication abuse was the most prevalent security weakness this quarter, observed in 65 percent of engagements — up sharply from 35 percent last quarter. Adversaries consistently defeated or bypassed MFA using AitM proxies and session-token theft, MFA fatigue attacks, registration of attacker-controlled devices for authentication, and legacy authentication protocols that circumvent MFA altogether. To reduce this risk, Talos IR recommends transitioning from push- and SMS-based MFA to phishing-resistant methods such as FIDO2/WebAuthn and hardware security keys. Organizations should also restrict self-service MFA enrollment by requiring helpdesk verification, block legacy authentication through Conditional Access, enforce number matching or verified push where phishing-resistant methods are not yet feasible, and condition access on device compliance and trusted infrastructure rather than geographic location alone.
Configure centralized logging with adequate retention across the environment
Insufficient logging and visibility was the second most common weakness, observed in 42 percent of engagements compared to 18 percent last quarter. Deficiencies included domain controller security logs retained for only a few hours, host event logs truncated or overwritten before capture, absent NetFlow that prevented reconstruction of external authentication and exfiltration, on-device-only logs that adversaries deleted to evade detection, and short cloud-telemetry retention that did not extend back to the true initial-access date. In several engagements these gaps prevented definitive determination of the initial access vector or the scope of data exfiltration. Talos IR recommends implementing a SIEM or centralized logging platform with a minimum of 90 days of retention, forwarding logs from servers, workstations, network infrastructure, cloud identity providers, and security appliances off-device so they survive log tampering and host rebuilds, and enabling process-creation, command-line, and cloud API (e.g., Microsoft Graph) auditing. Talos IR's Log Architecture Assessment service can identify gaps and provide a roadmap to a complete view of the environment.
Conduct robust patch management and reduce exposed infrastructure
Vulnerable, exposed, or unpatched internet-facing infrastructure was the third most common weakness, observed in 31 percent of engagements, similar to last quarter’s 25 percent. A variety of different vulnerabilities were targeted including ToolShell, an older Telerik UI deserialization flaw, and SD-WAN and perimeter-VPN appliance CVEs. Internet-exposed services were also subjected to SQL-injection and denial-of-service activity. Talos IR recommends identifying and prioritizing the patching or decommissioning of all end-of-life and externally exposed systems, isolating systems that cannot be immediately upgraded, restricting management plane and remote access services behind a VPN or trusted source, deploying a Web Application Firewall (WAF) with rules for known exploitation patterns, and establishing a vulnerability management process capable of rapidly identifying and patching exposed assets — particularly given the accelerating reduction in time between vulnerability disclosure and exploitation.
Enforce strict outbound email thresholds to disrupt attack propagation
Finally, unlimited outbound email thresholds were a notable security weakness this quarter, enabling threat actors to propagate malicious activity in almost 15 percent of engagements. Though not as prevalent as the above weaknesses, it was more frequently observed than in previous quarters and warrants mention. For example, in one engagement, a user clicked on a malicious phishing email that led to credential theft and account compromise. Shortly after the threat actors gained access to the user’s mailbox, they sent over 6,600 phishing and spam emails to continue the attack chain. The failure to contain the compromise via outbound rate limiting significantly amplifies the damage of a single compromised credential; implementing these controls is a low-effort, high-impact mitigation strategy that effectively disrupts the attack chain.
Top-observed MITRE ATT&CK techniques
The table below represents the MITRE ATT&CK techniques observed in this quarter’s Talos IR engagement. Given that some techniques can fall under multiple tactics, we grouped them under the most relevant tactic in which they were leveraged. Please note this is not an exhaustive list.
Key findings from the MITRE ATT&CK framework include:
Consistent with phishing being a top threat this quarter, email hiding rules was the most observed tactic for persistence while internal spearphishing was most seen for lateral movement.
Use of valid accounts was frequently observed for both privilege escalation and persistence, highlighting how identity abuse remains a key theme across engagements.
Actors also relied on legitimate tools and web protocols to challenge detection, abusing native email features and cloud APIs, relying on standard web protocols for C2, and using valid administrative credentials for RDP and SSH.
Tactic
Technique
Example
Reconnaissance (TA0043)
T1598 Phishing for Information
Adversaries may send phishing messages to elicit sensitive information that can be used during targeting. Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information.
T1595 Active Scanning
Adversaries may execute active reconnaissance scans to gather information that can be used during targeting.
T1593 Search Open Websites/Domains
Adversaries may search open websites and domains to gather information about a victim that can be used during targeting.
T1589 Gather Victim Identity Information
Adversaries may gather information about the victim's identity that can be used during targeting.
Initial Access (TA0001)
T1566 Phishing
Adversaries may send phishing messages to gain access to victim systems.
T1190 Exploit Public-Facing Application
Adversaries may exploit a vulnerability to gain access to a target system.
T1078 Valid Accounts
Adversaries may use compromised credentials to access valid accounts during their attack.
Execution (TA0002)
T1204.001 User Execution: Malicious Link
An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution.
T1078 Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts to access systems within the network and execute their payload.
Persistence (TA0003)
T1564.008 Hide Artifacts: Email Hiding Rules
Adversaries may use email rules to hide inbound emails in a compromised user's mailbox. Many email clients allow users to create inbox rules for various email functions, including moving emails to other folders, marking emails as read, or deleting emails.
T1663 Remote Access Software
Adversaries may use legitimate remote access software, such as VNC, TeamViewer, AirDroid, AirMirror, etc., to establish an interactive command and control channel to target mobile devices.
T1053 Scheduled Task/Job
Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code.
T1133 External Remote Services
Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations.
T1078 Valid Accounts
The adversary may compromise a valid account to move through the network to additional systems.
Defense Impairment (TA0112)
T1687 Exploitation for Defense Impairment
Adversaries may exploit vulnerabilities in security software, infrastructure, or defensive components to degrade, disable, or otherwise continue to impair their ability to prevent, detect, or respond to malicious activity.
T1078 Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
T1484 Domain or Tenant Policy Modification
Adversaries may modify the configuration settings of a domain or identity tenant to evade defenses and/or escalate privileges in centrally managed environments.
Stealth (TA0005)
T1564.008 Hide Artifacts: Email Hiding Rules
Adversaries may use email rules to hide inbound or outbound emails in a compromised user's mailbox.
T1070 Indicator Removal
Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses.
Credential Access (TA0006)
T1111 Multi-Factor Authentication Interception
Adversaries may target MFA mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and network resources.
Adversaries may attempt to bypass MFA mechanisms and gain access to accounts by generating MFA requests sent to users.
T1110.003 Brute Force: Password spraying
Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials.
Discovery (TA0007)
T1018 Remote System Discovery
Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
T1083 File and Directory Discovery
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
T1087 Account Discovery
Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment.
T1082 System Information Discovery
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
T1526 Cloud Service Discovery
An adversary may attempt to enumerate the cloud services running on a system after gaining access.
Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
T1534 Internal Spearphishing
After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional information or compromise other users within the same organization.
T1021.004 Remote Services: SSH
Adversaries may use Valid Accounts to log into remote machines using SSH. The adversary may then perform actions as the logged-on user.
Command and Control (TA0011)
T1219 Remote Access Software
An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network.
T1071.001 Application Layer Protocol: Web Protocols
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic.
T1102 Web Service
Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system.
T1572 Protocol Tunneling
Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems.
Exfiltration (TA0010)
T1567 Exfiltration Over Web Service
Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel.
T1048 Exfiltration Over Alternative Protocol
Adversaries may exfiltrate data over a different protocol than the command and control channel.
Impact (TA0040)
T1486 Data Encrypted for Impact
Adversaries may use ransomware to encrypt data on a target system.
from Cisco Talos Blog https://ift.tt/PnhGUQH
via IFTTT
STAR Labs has published a Linux kernel exploit that turns an ordinary local user into root on the CentOS Stream 9 build it targeted. The flaw, tracked as CVE-2026-53264 (CVSS score: 7.8), is a use-after-free race in the kernel's network traffic-control subsystem.
Researcher Lee Jia Jie said artificial intelligence (AI) helped him find the bug and speed up exploit development. This is local privilege escalation, not remote code execution, so an attacker needs a foothold on the machine before any of it applies.
The demonstrated exploit also requires unprivileged user namespaces, the CONFIG_NET_ACT_GACT and CONFIG_NET_CLS_FLOWER kernel options, and a kernel-specific return-oriented programming (ROP) chain containing hardcoded offsets. Those conditions narrow the immediate exposure, but full exploit source code is now public.
The upstream fix landed on June 1, 2026, and has since been backported to several stable kernel branches. The Linux CNA record lists vulnerable ranges beginning with Linux 4.14. Fixed releases are 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, and 7.0.13, with the mainline fix entering 7.1-rc7.
Linux users should install a distribution kernel carrying the fix rather than rely on the upstream version number alone. The Hacker News found no entry for the flaw in CISA's Known Exploited Vulnerabilities catalog and no official report of exploitation in the wild as of July 28, 2026.
Lee said in a technical write-up that AI assisted with vulnerability discovery, production of a Kernel Address Sanitizer (KASAN) proof of concept, and optimisation of the race window. STAR Labs also released the CentOS-targeted exploit code.
Without the model, prompts, service, or interaction record, the disclosure is difficult to use as a benchmark of AI capability or to separate the system's contribution from Lee's direction and judgement.
The Hacker News asked STAR Labs for details on the AI system, test environment, and disclosure timeline and will update this story with any response.
"AI still has many blind spots and lapses in reasoning ability," Lee said, adding that human judgement remained necessary throughout the work.
The vulnerability sits in the lifecycle handling of Linux traffic-control actions. Concurrent RTM_NEWTFILTER and RTM_DELTFILTER operations can leave one thread reading an action object after another thread has freed it. The upstream patch fixes the race by deferring the free operation until existing read-copy-update (RCU) readers have finished.
The exploit creates its own user and network namespaces, giving it namespace-local CAP_NET_ADMIN without requiring host administrator rights. It reaches the vulnerable path through a clsact qdisc and flower filter. Timerfd and epoll operations widen the race window, while key payload allocations reclaim the freed object. The ROP chain then overwrites core_pattern.
The exploit places a copy of itself in a memfd and deliberately crashes a child process, causing Linux to run the memfd-backed binary as the root core-dump handler in the initial namespace.
Lee reported that the exploit succeeded in all 10 of his test runs, taking between nine and 111 seconds on a laptop running CentOS Stream 9. Those reliability figures have not been independently reproduced. The exploit's fixed gadget offsets also mean it must be rebuilt for other kernel packages and may not be adaptable to some newer builds.
The practical risk is narrower than a generic "Linux root exploit" label may suggest, but public exploit code raises the urgency for compatible systems that remain unpatched.
The upstream patch credits Kyle Zeng, who uses the handle KyleBot, as the reporter. Lee said he found the flaw independently and only later learned that Zeng had reported it shortly before the TyphoonPwn 2026 competition. Lee published the later technical analysis and exploit code.
Distribution status remained uneven as of July 28: Debian lists fixed kernels for supported stable releases, Ubuntu still marks multiple maintained kernel packages vulnerable, and SUSE lists the issue as pending across multiple products. SUSE separately assigns the flaw a 5.5 score, using a vector that records only availability impact, below the Linux CNA's 7.8 assessment.
Those trackers show package status, not how many deployed systems have the required namespaces, kernel options, and a compatible kernel build. The public sources reviewed do not establish the population at immediate risk.
Lee wrote that the AI-heavy process made bug hunting "feel more like I was doing n-day analysis even on new bugs."
from The Hacker News https://ift.tt/TJzFP4G
via IFTTT
Microsoft has launched its first cybersecurity-specific model inside MDASH, its multi-model vulnerability identification and remediation harness.
The company says MDASH, using MAI-Cyber-1-Flash and GPT-5.4, scored 95.95% on CyberGym. It also claims the configuration costs 50% less than its current best MDASH combination of GPT-5.4, GPT-5.4 mini, and GPT-5.3 Codex. Access is limited to approved MDASH customers through an Azure AI Foundry private preview.
MAI-Cyber-1-Flash is designed to handle up to 90% of MDASH tasks, with GPT-5.4 reserved for the hardest 10%. It is available only inside MDASH, not as a standalone public model or general-purpose application programming interface.
The headline score belongs to MDASH running MAI-Cyber-1-Flash alongside GPT-5.4, not to the new model by itself. CyberGym Level 1 is a known-vulnerability reproduction test. It gives an agent a vulnerability description and the corresponding unpatched source code, then checks whether it can produce a working proof of concept. It does not measure blind vulnerability discovery or whether a generated patch is correct.
CyberGym's public leaderboard did not list Microsoft's 95.95% result when checked on July 28, 2026. It still listed Microsoft's May 12 MDASH submission at 88.4%. Microsoft's public materials do not say whether the result was submitted for listing.
Microsoft's earlier 96.55% MDASH result does not resolve the comparison. That June figure counted any crash, including non-target vulnerabilities. The July materials do not say whether the 95.95% result uses the same criterion, so the two scores cannot safely be read as a before-and-after performance trend.
According to Microsoft's model card, MAI-Cyber-1-Flash is a sparse mixture-of-experts transformer with 137 billion total parameters, five billion active parameters, and a 256,000-token context window. It is a cybersecurity fine-tune of MAI-Code-1-Flash, which was developed from a MAI-Thinking-1 mid-training checkpoint.
The model card says the evaluated configuration replaced 80% of MDASH's existing models and raised the reported CyberGym result from 88.4% to 95.95%. That 80% figure is the share of models replaced. The separate 90% figure is the maximum share of tasks Microsoft says the smaller model can handle.
Taken together, the disclosed design points to routing as the central technical claim: MAI-Cyber-1-Flash is intended to handle most tasks, GPT-5.4 takes the hardest remainder, and Microsoft reports the outcome at the MDASH system level.
Microsoft's launch announcement defines the 50% saving against its current best MDASH model mix of GPT-5.4, GPT-5.4 mini, and GPT-5.3 Codex. The product page separately describes the system as delivering "comparable performance at 50% of the cost of leading models." The announcement and model card do not disclose the token use, call volume, latency, task mix, or compute allocation behind that comparison, so the figure cannot yet be independently reproduced or normalised against other systems.
"The model is one input, the system around it is the product."
Taesoo Kim, Microsoft's vice president of agentic security, used that distinction when describing MDASH in June. Under a lightweight terminal harness, the model card reports scores of 0.314 on CVEBench, 0.553 on CyberSecEval4 threat intelligence, 0.33 on its malware-analysis test, and 0.651 on CRSBench at POV=1200.
The model scored zero across the kernel, userspace, and browser categories of ExploitGym, which asks agents to turn supplied vulnerabilities and crashing inputs into working code-execution exploits. Those results come from different tasks and scoring scales, so none is a standalone CyberGym score for MAI-Cyber-1-Flash.
Microsoft said all benchmark testing took place in a network-isolated environment with no access to production systems, the public internet, or external services. The model card also warns that generated text and code may be inaccurate or incomplete and should be reviewed before consequential use.
Software vulnerability management using MAI-Cyber-1-Flash inside MDASH is the first scenario Microsoft has announced for Project Perception, its broader system for coordinating defensive security agents. Project Perception is scheduled to enter public preview on August 3, with Microsoft planning to extend the model beyond software vulnerability work to additional security workflows.
from The Hacker News https://ift.tt/xkzD8YR
via IFTTT
A maximum-severity security flaw impacting on-premises versions of Arista VeloCloud Orchestrator (VCO) has come under active exploitation in the wild.
The vulnerability, tracked as CVE-2026-16812 (CVSS score: 10.0), is a case of operating system command injection that could pave the way for arbitrary code execution.
"VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host," Arista said in a Monday advisory.
"Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. This functionality was intended to be for internal use only and is not intended to be remotely accessible."
The American network equipment company said the issue has already been addressed in hosted and dedicated versions of VCO in advance. The following versions are affected -
VCO 5.2.x releases prior to 5.2.3.14
VCO 6.1.x releases prior to 6.1.3.4
VCO 6.4.x releases prior to 6.4.2.4
VCO 7.0.x releases prior to 7.0.0.1
Arista acknowledged that the vulnerability was externally discovered and known to be actively exploited, but did not reveal when it was disclosed and how many customers may have been potentially impacted as part of malicious cyber activity weaponizing the bug.
As indicators of compromise (IoCs), the company shared a set of three IP addresses that it said were responsible for "conducting the attacks," urging customers to block them and review the logs to determine if they are present -
8.19.75.217
206.72.242.124
206.72.242.162
"If compromise is suspected, operators should preserve VCO web access logs, backend application logs, system logs, database logs, and relevant file-system timestamps before remediation where operationally feasible," it added.
If immediate updating to a fixed VCO release is not an option, it's recommended to restrict access to the VCO web interface to trusted administrative networks, monitor the VCO for access from known malicious source IPs, check for unexpected outbound network activity from the VCO host, and review recent administrator activity for unexpected changes.
"Compromises to the VCO platform may allow attackers access to the VeloCloud Edge devices as well," Arista said. "This may include credential rotation, review of administrator activity, validation of managed device state, and restoration or replacement of affected orchestrator instances from trusted sources."
The development has prompted the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add the flaw to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patch by July 30, 2026.
News of active exploitation of CVE-2026-16812 arrives as the agency also added a medium-severity security vulnerability impacting Fortinet FortiOS SSL-VPN (CVE-2025-68686, CVSS score: 5.3) to the KEV catalog, citing evidence of active exploitation. The shortcoming was patched by Fortinet earlier this February.
"An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiOS SSL-VPN may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests," Fortinet said in an alert at the time. "An attacker would need first to have compromised the product via another vulnerability, at the file system level."
There are currently no details on how the vulnerability is being exploited in the wild, the scale of attacks, and who is behind them. Federal agencies have time till August 10, 2026, to apply the patches.
Another security flaw that has come under attack is CVE-2026-16723 (CVSS score: 9.0), a critical issue in Alibaba's Fastjson library that could allow remote code execution without user interaction or elevated privileges. The vulnerability remains unpatched. Developers using versions 1.2.68 through 1.2.83 are urged to enable SafeMode or switch to a non-impacted build as soon as possible.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
from The Hacker News https://ift.tt/9q8yYwp
via IFTTT
Public exploit details released on July 27 show how an unauthenticated request can reach PHP's eval() function inside vBulletin and execute code on an unpatched forum server. The attack requires no account, administrative access, or interaction from another user.
SSD Secure Disclosure lists vBulletin 6.2.1 and earlier, and 6.1.6 and earlier, as affected, but does not give a lower version boundary. vBulletin issued security patches for 6.2.1, 6.2.0, and 6.1.6 at the end of June and released the fixed version 6.2.2 on July 1, nearly four weeks before the exploit went public
Administrators running self-hosted installations should apply the patch for their branch or upgrade to 6.2.2. vBulletin says its Cloud sites have already been patched against the flaw.
SSD did not report active exploitation. As of July 27, 2026, no source had confirmed in-the-wild attacks, and CVE-2026-61511 was not listed in CISA's Known Exploited Vulnerabilities catalog. The company published an interactive proof-of-concept, but the script as posted contains a one-character error, a letter where a digit belongs, that stops it running unchanged.
The mistake is trivial to correct and does not affect the underlying vulnerability. One thing the public record does not settle is whether the flaw was used in the roughly four weeks between the late-June patch and the July 27 disclosure; neither SSD's advisory nor vBulletin's notices address that window.
SSD's technical analysis identifies it as CVE-2026-61511, an unauthenticated remote code execution flaw in vBulletin's template engine. No CVE.org or National Vulnerability Database record, and so no official severity score, was available at the time of writing; the NVD stopped routinely enriching new CVEs with CVSS scores earlier this year.
SSD credits an unnamed independent researcher, though the published exploit is signed "EgiX," the handle of Egidio Romano, who disclosed vBulletin's 2025 template-engine code-execution chain.
The vulnerable code sits in /includes/vb5/template/runtime.php, inside the vB5_Template_Runtime::runMaths() method, which handles inline math in templates. The function strips characters outside a restricted set, then passes what remains directly to eval(). The filter blocks letters but permits digits, parentheses, concatenation, arithmetic operators, and binary operators such as XOR, enough to reconstruct PHP strings and callable function names without any letters, using a restricted-character technique the advisory calls "phpfuck."
Reaching it does not require the admin panel. vBulletin renders templates over a public route, ajax/render/pagenav, and the stock pagenav template copies a visitor-supplied pagenav[pagenumber] value into a {vb:math} tag, which passes it to runMaths().
That chain is what turns a template bug into pre-authentication remote code execution; SSD's PoC uses it to rebuild PHP's system function and run an operating-system command, returning the output in the HTTP response.
The Hacker News reproduced the disclosed filtering and evaluation logic locally to check the reported error. With the typo corrected, a harmless strlen() test payload executed; without it, the allowlist stripped the stray letter and left syntactically invalid PHP. The test confirmed the expression-building flaw, not a complete attack against a live vBulletin server.
The exploit's own banner calls the issue a zero-day, but the vendor's patches and the 6.2.2 release preceded public disclosure by nearly four weeks. The exploit code is new; the flaw it targets was already fixed. With Cloud reportedly patched and the self-hosted fixes nearly a month old, the live risk is concentrated in self-hosted, internet-facing forums that have not updated, a more specific population than a bare "vBulletin RCE" implies.
Defenders can review POST requests carrying routestring=ajax/render/pagenav with unusually long or operator-heavy pagenav[pagenumber] values, a pattern derived from the public PoC rather than vendor detection guidance.
This is the same corner of vBulletin that has produced pre-authentication code execution before. The May 2025 chain, CVE-2025-48827 and CVE-2025-48828, abused the template engine through a different path and drew exploitation attempts within days of disclosure, after the vendor had quietly patched it months earlier and many forums never applied the fix.
Each round has run the same way. A quiet fix goes out first, a working exploit surfaces weeks later, and by then many internet-facing forums are still running the vulnerable builds.
from The Hacker News https://ift.tt/4tn0Brq
via IFTTT
