Raheim Hamilton, co-creator and operator of the Empire Market dark web marketplace, was sentenced to 40 years in prison for facilitating $430 million in illegal transactions from 2018 to 2020. Empire Market was a major darknet marketplace specializing in drug sales, counterfeit currency, stolen credentials, and hacking tools. The marketplace operated on the Tor network and used cryptocurrency transactions with tumbling and mixing services to conceal user identities. Law enforcement conducted undercover purchases and seized significant quantities of drugs and cryptocurrency. Hamilton and his co-defendant also managed dispute resolution and vendor ratings to support illicit trade.
Multiple vulnerabilities affecting TP-Link's Aginet line of ISP-managed mesh systems, routers, and modems have been disclosed, allowing unauthenticated or low-privileged attackers on the same network to fully compromise devices. These include authentication bypass, privilege escalation, command injection, use of hardcoded encryption keys, and physical access exploits. The vulnerabilities have led to state lawsuits accusing TP-Link of misleading consumers about device security and ties to China. TP-Link distributes firmware updates via ISPs, with fixes rolling out into 2026. The company denies the allegations and claims its US devices are manufactured in Vietnam and not controlled by foreign governments.
Cisco Talos identified an advanced persistent threat (APT) spear-phishing campaign targeting Taiwan research organizations. The campaign used AI-assisted content generation to craft personalized phishing emails impersonating reputable academic and policy institutions. It combined traditional email phishing with QR code phishing (quishing) by modifying legitimate event posters with malicious QR codes. The phishing infrastructure included an advanced adversary-in-the-middle (AitM) framework impersonating Google authentication pages to intercept credentials and multi-factor authentication challenges in real time. The campaign leveraged legitimate event details as cover but redirected victims to actor-controlled phishing sites. The phishing kit's UI was originally developed in Simplified Chinese and adapted for Traditional Chinese and English, suggesting a developer with a Simplified Chinese primary language background.
This analysis covers a new class of malware techniques called AI-analysis evasion (A3), where malware authors embed natural-language instructions in plaintext within malware samples to manipulate or evade automated AI-based analysis tools. These instructions are designed to mislead language models that analyze extracted text from binaries, causing them to misclassify or ignore malicious content. The technique is cheap to implement but only partially effective, influencing outcomes in about 35% of tests. Several malware families, including FRUITSHELL, PLOTSAFE, HOLLOWCLAD, and MANTLEMAZE, have adopted and evolved these evasion methods. The embedded instructions do not affect malware execution but aim to confuse AI analysis pipelines. Despite attempts to intimidate or mislead AI tools, these evasion methods remain detectable as they rely on plaintext strings. This represents an emerging layer of anti-analysis distinct from traditional binary obfuscation or packing.
CVE-2026-107510 is a critical vulnerability in Infoblox NIOS where an authenticated user with high privileges can inject arguments into troubleshooting commands, leading to privilege escalation. This flaw allows the attacker to gain elevated privileges beyond their initial access level, potentially impacting confidentiality, integrity, and availability of the system.
Eclipse Ditto Explorer UI versions 3.6.0 to 3.8.13 and 3.9.0 to 3.9.7 have a vulnerability where the UI loads environment configuration from an attacker-controlled URL without user confirmation. This allows an attacker to set malicious OpenID Connect (OIDC) provider settings or API URIs, leading to theft of access and refresh tokens or bearer credentials. The vulnerability is fixed in versions 3.8.14 and 3.9.8.
In Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can extract stored management credentials for onboarded SANnav instances and compromise connected Brocade SANnav servers or managed Brocade Fibre Channel switches.
An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions before 3.5.0 to enumerate the configuration details and state of managed Brocade Fabric OS (FOS) switches. This results in the unauthorized disclosure of the customer's SAN fabric management topology and switch connectivity attributes.
When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal sequences contained within archive entries prior to extraction. An unauthenticated remote attacker capable of sending or intercepting ingested archive files can leverage this flaw to write arbitrary files to restricted locations on the underlying host, potentially leading to remote code execution.
An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including accessing sensitive system configuration mapping data, modifying managed device inventories, and altering operational settings. This vulnerability affects all versions of Brocade ASCG before 3.5.0.
Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer. Any local authenticated user with read access to the installation path can discover this credential and perform privilege escalation on affected Open Virtual Appliance (OVA) deployments, where default configuration settings remain in place.
Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation. When an authenticated user submits a configuration form, the submitted text could immediately be processed. A malicious actor with basic access can supply crafted input to execute arbitrary code on the server and take control of the application.
Zohar Pinhasi, owner of MonsterCloud, was charged with defrauding ransomware victims by falsely claiming to decrypt data without paying attackers. Instead, he paid ransoms to obtain decryption keys and charged victims a substantial markup for remediation services. The scheme involved paying over $8 million in ransoms while charging clients over $19 million. He faces wire fraud charges and potential lengthy prison sentences.
This report discusses the disclosure of a hardcoded signing key flag in an Android context, as presented in a Hacker101 CTF challenge write-up. The information is sourced from a Medium blog post shared on Reddit's ExploitDev community. No specific affected software versions or vendor advisories are provided. There is no indication of active exploitation in the wild or available patches.
OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter.
This analysis examines the security of LTE connectivity in connected cars, focusing on Tesla as a case study. It highlights that Tesla's cellular communication stack is vulnerable to IMSI catching attacks, which can lead to identity disclosure. The study emphasizes a systemic issue in cellular networks where transmitters are unauthenticated and receivers do not prioritize trust, allowing adversaries to force devices to leak sensitive identifiers without detection. The findings raise concerns about the privacy and security of connected vehicles relying on LTE networks.
The npm package '@dransay/address-validation' version 99.0.0 contains a preinstall script that performs a DNS lookup and HTTPS GET request to a known malicious collaborator domain during installation. This behavior is consistent with a dependency confusion probe designed to reveal the installer's IP address and package name to an external operator. No sensitive environment data or filesystem contents are accessed, and no additional code is fetched or executed. The package is flagged as malicious due to its communication with a domain associated with malicious activity.
An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account information through the /dolphinscheduler/users/list-all endpoint without the required permissions.
The endpoint fails to enforce the necessary authorization checks before returning user account information. As a result, an authenticated user can access account information they are not authorized to view.
Successful exploitation may expose sensitive user information and facilitate account enumeration.
This issue affects Apache DolphinScheduler: before 3.4.3.
Users are recommended to upgrade to version 3.4.3, which fixes the issue.
An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration. The exposed kubeconfig data contains credentials that may allow users to authenticate directly to the Kubernetes API outside DolphinScheduler.
The impact depends on the permissions granted to the disclosed credentials. If the kubeconfig provides cluster-admin or broadly privileged service-account access, an attacker may read Kubernetes Secrets, create pods, and establish persistent access to the cluster.
This issue affects Apache DolphinScheduler: from 3.2.0 before 3.4.3.
Users are recommended to upgrade to version 3.4.3, which fixes the issue.
An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints.
These endpoints fail to enforce the required data source access controls and return sensitive connection information, including data source passwords. As a result, an authenticated user without permission to access a data source can retrieve its connection details and credentials.
Successful exploitation exposes sensitive data source information and may enable unauthorized access to the underlying databases using the disclosed credentials.
This issue affects Apache DolphinScheduler: before 3.4.3.
Users are recommended to upgrade to version 3.4.3, which fixes the issue.