Threat database

CFITSIO versions up to 4.7.0 contain a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers. This flaw allows attackers to read memory before the fits_rand_value table by using a zero or negative ZDITHER0 seed in a crafted FITS file with a SUBTRACTIVE_DITHER_1 compressed image. Exploitation occurs when the file is processed via fits_open_file() and fits_read_pix(), potentially causing crashes or leaking heap memory contents.

CVE-2026-92777 is a medium severity vulnerability in Lenovo Idea Tab Pro (TB373FU) tablets. It involves the use of a default cryptographic key that could allow a user with physical access to an unlocked device to bypass protections and execute arbitrary code. The vulnerability affects multiple firmware versions prior to various 17.x.x.xxx releases. There are no known exploits in the wild and no official patch information provided.

A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code with elevated privileges.

A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated user to cause a blue screen error.

CVE-2026-89057 is a high-severity authentication bypass vulnerability affecting Lenovo Idea Tab Pro (TB373FU) tablets. It allows a user with physical access to bypass authentication and gain unauthorized access to the device. The vulnerability is identified as CWE-288, involving authentication bypass via an alternate path or channel. Multiple firmware versions prior to 17.5.10.362 are affected. No vendor patch or remediation details are provided in the available data.

A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on the same logical network to execute arbitrary code.

A potential vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an unauthorized remote user to disclose sensitive information.

A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications.

Panchan is a peer-to-peer crypto mining worm first identified in 2022 that propagates by stealing SSH keys and using a rootkit to maintain persistence. It targets insecure internet-facing servers, especially those with exposed SSH services lacking proper access controls. The worm uses a Discord channel as its command-and-control server and can pivot to other hosts by leveraging stolen SSH credentials. Indicators of compromise include repeated failed SSH login attempts, unusual resource usage, hidden directories with high-entropy names, and network traffic to Discord. Mitigations include implementing egress and ingress filtering, access control lists, multi-factor authentication for SSH, disabling root login, using SSH key management solutions like HashiCorp Vault, and deploying firewalls and intrusion detection/prevention systems. Monitoring via SIEM solutions is recommended for scalable detection. Systems with strong security controls are not vulnerable to this worm.

Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-110916 is an improper input validation vulnerability in Google Chrome Desktop versions prior to 155.0.8059.84. This flaw allows a remote attacker to potentially execute arbitrary code outside the sandbox by crafting a malicious HTML page. The vulnerability has a critical severity rating with a CVSS score of 9.6.

Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)

Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)

Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

An AI-powered espionage campaign, tracked as CL-UNK-1211, targeted government and state-affiliated Linux infrastructure from October 2025 to April 2026. The attackers used AI-generated payloads, custom malware, web shells, and credential harvesting techniques to maintain persistent access and conduct reconnaissance. They deployed multiple web shells, modified PHP configurations for persistence, and used advanced anti-forensics methods including disabling endpoint protections and tampering with system logs. Credential theft was achieved through hijacked .bashrc files and PHP login page modifications. The campaign aimed to dump sensitive databases and exfiltrate government mailboxes to access social media accounts. The attackers combined open-source tools with custom cross-platform backdoors and employed AI to streamline payload creation. No specific patch or fix is mentioned.