The 'Iron Man System' is a commercial Phishing-as-a-Service (PhaaS) operation that provides criminal buyers with a self-hosted phishing kit. It includes over 2,360 phishing templates impersonating trusted entities such as postal services, banks, and government agencies, targeting 130 countries. The system features a bilingual Chinese-English interface, a subscription licensing model tied to vendor-controlled authorization servers, and a build registry with 911 published versions. Resecurity, in collaboration with Microsoft's Digital Crimes Unit and industry partners, mapped and disrupted this infrastructure. The kit was used to send approximately 1 billion phishing emails targeting 75,000 organizations, capturing around 17.4GB of telemetry data. Multiple domains associated with the infrastructure have been identified as indicators of compromise.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.17.59. See the following advisory for the container images for this release:
https://access.redhat.com/errata/RHSA-2026:77552
Security Fix(es):
* net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.
CVE-2026-104103 is a path traversal vulnerability in ludwig-ai's ludwig framework prior to version 0.17.8. The flaw exists in the extract_archive() function, which improperly validates symlink and hard-link members in tar archives, allowing crafted archives to write files outside the intended extraction directory. This can lead to attacker-controlled content being placed at arbitrary filesystem paths with the privileges of the extracting process. The issue affects Python 3.12 and 3.13 runtimes but not Python 3.14, which rejects such escaping links by default. The vulnerability is fixed in version 0.17.8.
Red Hat OpenShift Logging 6.0.17 is a cluster-wide logging solution for OpenShift that collects and manages applications, infrastructure, and audit logs.
A coordinated disruption targeted Chinese-speaking cybercriminals operating three major phishing kits—CoGUI, CoAceV, and CoFish_Ws—that distributed hundreds of millions of credential phishing messages primarily against Japanese organizations. These phishing campaigns impersonated 66 well-known consumer and finance brands to steal usernames, passwords, and payment data. The threat actors used sophisticated evasion techniques, including approximately 17,000 unique rotating domains. The disruption involved civil lawsuits and domain seizures against ecosystem enablers YAM Store and Iron Man, conducted collaboratively by Microsoft, Health-ISAC, and security partners. This action is expected to significantly disrupt multiple threat groups involved in financial fraud within the Chinese phishing ecosystem.
The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities
and certificates as first-class resource types in the Kubernetes API. This makes it possible to provide
certificates-as-a-service to developers working within your Kubernetes cluster.
TeamPlus Messenger by TEAMPLUS TECHNOLOGY has a code injection vulnerability (CWE-94) that allows unauthenticated remote attackers to inject and execute arbitrary JavaScript. Exploitation requires tricking a user into interacting with crafted content and confirming a Windows security warning, leading to code execution with the current user's privileges. Versions from 16.8.0 through 17.0.6 are affected. The vulnerability has a high severity score of 8.6 CVSS 4.0.
TeamPlus Messenger versions 16.8.0 through 17.0.6 contain a code injection vulnerability (CWE-94) that allows unauthenticated remote attackers to execute arbitrary JavaScript by tricking users into opening a crafted link. Successful exploitation requires the user to confirm a Windows security warning, after which arbitrary code can run with the current user's privileges.
CVE-2026-94512 is a heap-based buffer overflow vulnerability in Microsoft SQL Server 2017 (GDR) and later versions up to specified fixed releases. This flaw allows an authorized attacker with network access and low complexity to execute arbitrary code without user interaction. The vulnerability affects multiple branches of SQL Server versions 14.x through 17.x and has been assigned a high severity score of 8.8. Official patches are available for all affected versions.
IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.10 contain a vulnerability related to deserialization of untrusted data. This flaw allows an unauthenticated remote attacker to corrupt the persisted status of batch job instances. The vulnerability has a high severity with a CVSS score of 8.2, indicating significant impact on integrity and some impact on availability.
IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.10 contain a critical authentication bypass vulnerability related to session fixation when the samlWeb-2.0 feature is enabled. This flaw allows an attacker to bypass authentication, potentially leading to full compromise of confidentiality and integrity without requiring user interaction.
CVE-2026-101294 is a high-severity vulnerability in IBM WebSphere Application Server - Liberty and IBM WebSphere Application Server versions 8.5 and 9.0. It involves a missing cryptographic step that allows a remote attacker to bypass cryptographic signature verification due to improper verification of the cryptographic signature. This flaw affects versions 17.0.0.3 through 26.0.0.10 of WebSphere Application Server - Liberty and versions 8.5 and 9.0 of WebSphere Application Server. The vulnerability has a CVSS 3.1 score of 8.7, indicating a high impact on confidentiality and integrity without requiring privileges or user interaction. No patch or remediation information is provided in the available data.
CVE-2026-105442 is a high-severity vulnerability in IBM WebSphere Application Server versions 8.5, 9.0, and Liberty editions from 17.0.0.3 through 26.0.0.10. It involves insecure deserialization of untrusted data in the messaging service, which could allow a remote attacker to cause a denial of service. The vulnerability does not impact confidentiality or integrity but affects availability.
IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.9 are affected by a privilege escalation vulnerability when the restConnector-2.0 feature is enabled. This vulnerability involves incorrect authorization, potentially allowing users with limited privileges to escalate their access rights. The CVSS v3.1 base score is 5.4, indicating a medium severity issue.
CVE-2026-14532 is an integer overflow or wraparound vulnerability in IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.9. A user with Reader role privileges could exploit this flaw to obtain version information, which leads to an uncaught exception. The vulnerability has a medium severity rating with a CVSS score of 4.3. No information about available patches or vendor advisories is provided.
IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.9 contain an information disclosure vulnerability (CWE-209) that allows an authenticated attacker to obtain sensitive information when the restConnector-2.0 feature is enabled. The vulnerability involves generation of error messages that expose sensitive data. The CVSS 3.1 base score is 6.5, indicating a medium severity issue.
CVE-2026-77816 is a vulnerability in IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.9. It involves improper certificate validation in the administrative client, which could allow a man-in-the-middle attacker to obtain sensitive information. The vulnerability has a medium severity with a CVSS score of 6.5.
CVE-2026-79715 is a path traversal vulnerability in IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.9. It allows a local attacker to use a specially crafted application archive to write files outside the intended directory. This could lead to unauthorized file modification on the system.
CVE-2026-96237 is a high-severity vulnerability in Microsoft .NET runtime versions 8.0, 9.0, 10.0, 17.14, and 18.10 prior to specific fixed releases. It involves the inclusion of functionality from an untrusted control sphere, allowing an unauthorized attacker to execute code remotely over a network. The vulnerability has been officially fixed in versions 8.0.132, 9.0.319, 10.0.113, 17.14.42, and 18.10.4.
CVE-2026-96230 is a high-severity cross-site scripting (XSS) vulnerability in Microsoft Visual Studio 2022 version 17.14 and related versions. It arises from improper neutralization of input during web page generation in ASP.NET Core, allowing unauthorized attackers to execute code over a network. The vulnerability affects specific version ranges of Visual Studio 2022 and has been officially fixed in later versions.
