Search: mail-service.pe.hu

A cybersecurity startup dangling millions of dollars to acquire zero-day security vulnerabilities in popular software is run by a pair of far-right conspiracy theorists and convicted felons whose most recent ventures included fake intelligence companies and a now-defunct AI-based lobbying platform they operated under assumed names. The X/Twitter account IRIS C2 (@C2IRIS) has gained more than 4,000 followers since its creation in January 2025, posting frequently about security vulnerabilities, AI and software exploits. IRIS C2 says it is a company in McLean, Va. that sells offensive cybersecurity capabilities. The IRIS C2 website dangles the possibility of million-dollar payouts for exploits to attract talent. “Our business model is this,” reads a pinned post on top of the IRIS C2 account on X. “Attract the very best vulnerability researchers and exploit developers in the world to join our company. This mostly revolves around junior engineers with raw talent/extremely high IQ. We don’t care if they have a college degree/industry experience.” The website linked in that profile — irisc2[.]com — says the company is hiring for a number of open positions, and a recent post on its LinkedIn page enthuses about an overwhelming number of applications from potential employees. The website claims IRIS C2 is in the business of acquiring “zero-day exploits, individual primitives, partial chains, and full capabilities across all major platforms. Payouts range from $10,000 to $7 million depending on target, reliability, and operational value.” The government contracting portal g2exchange.com reports that irisc2[.]com is operated by a business based in Virginia called Calvexa Group LLC . The “contact” link on the website for Calvexa Group — calvexagroup[.]com — forwards visitors to irisc2[.]com. G2Exchange shows that while Calvexa Group LLC is registered as a federal contractor, it does not appear to be working on any direct government contracts. A search on the Arlington, Va. address listed in the incorporation records for Calvexa Group LLC finds the property is occupied by Jack Burkman , the 60-year-old founder and managing partner of the lobbying firm Burkman & Associates . When approached with questions about IRIS C2, Burkman referred further inquiries to his longtime associate, 28-year-old Jacob Wohl . Jack Burkman (left) and Jacob Wohl, at a press conference in August 2020. Image: Wikipedia. Burkman and Wohl have a storied history of creating fake intelligence companies and using them to spread false claims about and frame public figures, including fabricated sexual assault claims against then FBI director Robert Mueller , and Pete Buttigieg , then mayor of South Bend, Indiana and a Democratic candidate for the presidency. In 2019, Burkman and Wohl held press conferences falsely alleging extramarital affairs by Sen. Elizabeth Warren (D-Mass.) and then-2020 presidential candidate Kamala Harris . In the wake of the 2020 presidential election, Wohl and Burkman were prosecuted by multiple U.S. states for making thousands of robocalls to residents of battleground states and disseminating false claims about mail-in ballots. They were indicted in Cleveland on 15 felony counts of orchestrating a robocall scheme aimed at suppressing the black vote in Detroit, and were sentenced in late 2025 to probation after their appeals to dismiss the charges were rejected. In 2022, Wohl and Burkman both pleaded guilty to a single felony charge of telecommunications fraud in Ohio, and sentenced to a fine, probation, and community service. In March 2023, a judge in a New York civil case ruled that Wohl and Burkman had violated federal and state civil rights laws, and the two agreed to pay a $1 million settlement. In June 2023, the Federal Communications Commission (FCC) imposed a $5.1 million fine against Wohl and Burkman for their robocall campaigns, at the time the largest fine ever sought by the FCC under the Telephone Consumer Protection Act. Jacob “Jay” Wo…

### Summary `aiosmtplib`'s `SMTP.mail()`, `SMTP.rcpt()`, `SMTP.vrfy()` and `SMTP.expn()` send the caller-supplied email address to the server without rejecting embedded CR/LF (`\r\n`) bytes. An address that contains a CR/LF is written verbatim onto the SMTP control connection, so the bytes after the CRLF are framed by the server as one or more **additional, standalone SMTP command lines**. A caller that passes an attacker-influenced sender or recipient address into `mail()`/`rcpt()` (or `vrfy()`/`expn()`) therefore allows **SMTP command injection** (CWE-93 / CWE-77): the attacker can smuggle arbitrary SMTP verbs such as `MAIL FROM`, `RCPT TO`, `RSET`, `DATA`, or `AUTH` into the session. Injected commands will cause the `SMTP` instance to hang, but all commands required to complete the envelope could be sent in one address string. The `SMTP.sendmail()` command will pass sender and recipient addresses verbatim through to `SMTP.mail()` & `SMTP.rcpt()`, and so is also vulnerable. `SMTP.send_message()` is not affected. ### Impact Severity: medium. Type: SMTP protocol command injection (CWE-93 — Improper Neutralization of CRLF Sequences; CWE-77 — Command Injection). When an application built on `aiosmtplib` derives the envelope sender or any recipient from data an attacker can influence (a web form etc.) and passes it to `mail()`/`rcpt()` (directly, or via `sendmail()`/`send()` without a `Message` object), the attacker can: - desynchronize the command/response pipeline and cause the aiosmtplib client to hang, resulting in a possible denial of service - inject multiple commands in one address to send an arbitrary message The address only needs to reach `mail()`/`rcpt()`/`vrfy()`/`expn()`; no attacker control over the SMTP server is required. ### Vulnerable versions Affected version: `aiosmtplib` 5.1.0 (latest at time of report) and all earlier releases. ### Credit Reported by tonghuaroot.

--- title: Unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats product: 9Router version: <= 0.4.41 severity: critical cve_request: true --- ## Summary Multiple critical API security vulnerabilities were discovered in 9Router's Next.js dashboard. The `/api/providers` endpoints lack authentication entirely, allowing anyone to create, read, update, and delete provider connections. Additionally, `/api/usage/stats` exposes full plaintext API keys, and `/api/usage/request-logs` + `/api/usage/request-details` expose all users' request history and full conversation contents (including system prompts, user messages, assistant responses) without authentication. ## Affected Endpoints | Endpoint | Method | Issue | |---|---|---| | `/api/providers` | GET | Lists all provider connections with partial credentials, OAuth tokens, account IDs | | `/api/providers/:id` | GET | Read any single provider detail (IDOR) | | `/api/providers` | POST | Create arbitrary provider connections with attacker-controlled API keys | | `/api/providers/:id` | PUT | Modify any existing provider connection | | `/api/providers/:id` | DELETE | Delete any provider connection | | `/api/usage/stats` | GET | Exposes full plaintext API keys, per-account usage breakdown, cost data | | `/api/usage/request-logs` | GET | Exposes all users' request logs (model, tokens, cost, timestamp, provider) | | `/api/usage/request-details/:id` | GET | Exposes full conversation turns including system prompts, user messages, assistant responses | | `/api/version` | GET | Exposes current version info | | `/api/models` | GET | Exposes full model routing catalog | | `/api/v1/models` | GET | Exposes model list | ## Impact ### Critical: Provider CRUD without authentication An attacker can: 1. **Add a malicious provider** — inject a provider that proxies through their server, capturing all prompts, responses, and API keys routed through 9Router 2. **Modify existing providers** — replace API keys with attacker-controlled ones, redirect traffic 3. **Delete all providers** — cause complete denial of service 4. **Read all provider configurations** — harvest partial credentials, GitHub Copilot OAuth tokens, Cloudflare account IDs, email addresses ### Critical: Full API key leak via /api/usage/stats The endpoint returns complete API key strings (e.g., `sk-...`) in plaintext alongside usage data per key, enabling unauthorized use of connected AI provider accounts. ### Critical: Conversation history leak `/api/usage/request-details` returns the full conversation history of other users' AI sessions, including system prompts, user messages, assistant responses, tool calls, and reasoning traces. ## Steps to Reproduce ### 1. Unauthenticated read of all providers ```bash curl -s https://<host>/api/providers ``` Returns all provider connections with email addresses, auth type, account IDs, and partial API key prefixes. ### 2. Create a provider without authentication ```bash curl -X POST https://<host>/api/providers \ -H "Content-Type: application/json" \ -d '{"provider":"openai","authType":"apikey","name":"rogue","apiKey":"sk-attacker-controlled"}' ``` Returns the created connection object with a new UUID and `isActive: true`. ### 3. Modify an existing provider without authentication ```bash curl -X PUT https://<host>/api/providers/<existing-uuid> \ -H "Content-Type: application/json" \ -d '{"name":"modified","apiKey":"sk-attacker-key"}' ``` Returns the updated connection object. ### 4. Delete a provider without authentication ```bash curl -X DELETE https://<host>/api/providers/<existing-uuid> ``` Returns `{"message":"Connection deleted successfully"}`. ### 5. Read full usage stats with API keys ```bash curl -s https://<host>/api/usage/stats ``` Returns full API key strings, per-account token/cost breakdown, recent requests. ### 6. Read request logs ```bash curl -s "https://<host>/api/usage/request-logs?page=1&pageSize=50" ``` Returns paginated request logs with timestamps, models, providers, user emails, token counts. ### 7. Read full conversation ```bash curl -s https://<host>/api/usage/request-details/<request-uuid> ``` Returns complete conversation turns for that request. ### 8. Read version info ```bash curl -s https://<host>/api/version ``` Returns `{"currentVersion":"0.4.19","latestVersion":"0.4.45","hasUpdate":true}`. ## Root Cause The Next.js API routes under `src/app/api/*` lack authentication middleware on several endpoints. Specifically: - `/api/providers/*` — No auth check before CRUD operations on provider connections stored in the database - `/api/usage/stats` — No auth check before returning aggregated usage data including full API keys - `/api/usage/request-logs` — No auth check before returning request history - `/api/usage/request-details/:id` — No auth check before returning full conversation contents ## Suggested Fix 1. Add authentication middleware to all `/api/providers/*` routes (GET, POST,

pinokio-redis is a malicious npm package and part of the multi-wave "forge-jsx" cross-platform RAT campaign (Wave 4). It was published by npm account 'donimique' (donimiqueakers@gmail.com). The package.json description ('Node.js integration layer for Autodesk Forge') and the bundled README.md (literally titled "# forge-jsx") do not match the package name or the shipped code. On npm install the declared postinstall chain (postinstall-clipboard-event.mjs, ensure-dist.mjs, postinstall-durable-materialize.mjs, postinstall-bootstrap.mjs, postinstall-agent.mjs) runs scripts/postinstall-agent.mjs, which spawns dist/cli-agent.js as a detached, window-hidden background process. The agent connects over WebSocket to a command-and-control relay whose host, ports and default password are stored as an AES-256-GCM blob in dist/deploymentCipherData.js and decrypted at runtime by XOR-reconstructing a 32-byte key from two halves embedded in dist/deploymentDefaults.js. The decrypted C2 configuration is publicHost 212.193.3.61, relayPort 9877 (WebSocket relay), apiPort 8765 (HTTP API), default password 'secret'. Postinstall also registers OS-level autostart (Windows Run key, macOS LaunchAgent, Linux systemd/XDG autostart; service name forge-js-worker) pointing at a durable copy of the agent stored in a hidden '.forge-jsxy' directory under the platform application-data folder, so the implant survives removal of the npm package. Once running it performs credential-grade theft: dist/secretScan/agentStartupAudit.js walks the filesystem for BIP39-checksum-valid mnemonics, secp256k1/WIF private keys and BIP32 extended keys (xprv/tprv/zprv); dist/chromiumExtensionDbHarvest.js enumerates Chromium/Edge/Brave/Vivaldi/Yandex/Opera profiles across Windows, macOS and Linux and copies extension LevelDB stores (including MetaMask/Phantom-shaped wallet stores); harvested data is uploaded to the Hugging Face Hub using an embedded hf_ write token (dist/hfCredentials.js) or delivered via the relay; dist/hostInventorySend.js POSTs host inventory (hostname/platform/node/OS) to the relay and dist/discordRelayUpload.js forwards agent-side PNG screenshots to per-client Discord channels. This is the first wave of the campaign to ship rotated AES key material (new DEPLOYMENT_KEY_A/KEY_B/MASK_A/MASK_B byte arrays, hex 12335cede9edad1edbce89fd3ef0836c8edd3778e48f3f38f2330198ec8b1eb0), verified byte-identical across the four donimique-account packages (zod-pino434, zod-pino444, zredis-typed, pinokio-redis) — a single shared build. C2 212.193.3.61 (AS206216, Advin Services LLC, Nurnberg DE) is reused from the Wave 3 pino-zod/zod-pino IP rotation. The campaign is definitively linked by shared C2 infrastructure, the hardcoded '.forge-jsxy' durable directory, the dist/deploymentCipherData.js + dist/deploymentDefaults.js XOR-key fingerprint, and the '# forge-jsx' README tell that spans multiple package names and npm accounts. Only one version of pinokio-redis (1.0.127) exists and all versions are malicious. Tarball SHA-256: a400b0342add77fd3a58e086334b35e11d79e234b180bb360f48adcd61ec4acd, SHA-1: 04b6035df92ef9eb790d64d425c05c51fce46ca7. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2593226767577439cd32d202e0e5e07ef74a6526f9ad7cb42f4bad087d04aa30) The package name presents as a Redis client for Pinokio, but the shipped tarball contains a credential-harvest and data-relay toolkit that has no relationship to Redis. dist/discordRelayUpload.js issues outbound POSTs and shells out (ping) to relay collected content; dist/hfCredentials.js and dist/secretScan/contentScanner.js decode base64-embedded blobs (Buffer.from(..., 'base64')) at runtime; dist/secretScan/agentStartupAudit.js performs fetch() calls to huggingface.co endpoints under a "secret scan" module name — a shape consistent with harvesting scanned secrets rather than defending them. dist/deploymentDefaults.js and scripts/encode-deployment.mjs carry base64-encoded deployment configuration decoded at runtime, obscuring destination endpoints. scripts/postinstall-agent.mjs runs at npm install (postinstall) and issues network activity (GET, ping) on install without user interaction, providing auto-execution on default install. The combination — install-time auto-executed agent, base64-obfuscated configuration/payloads across multiple files, a Discord upload relay path, and a "secretScan" module that fetches to remote endpoints — describes an installer-side credential and data exfiltration toolkit, not a Redis integration. Name/purpose mismatch, install-time execution, and multi-file obfuscation together satisfy the active-attack shape. ## Source: ghsa-malware (d8c9c7ad731c0929056de138dff2c461e808854d25aea316f6fe865a3d04d8c0) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full co

zredis-typed is a malicious npm package and part of the multi-wave "forge-jsx" cross-platform RAT campaign (Wave 4). It was published by npm account 'donimique' (donimiqueakers@gmail.com). The package.json description ('Node.js integration layer for Autodesk Forge') and the bundled README.md (literally titled "# forge-jsx") do not match the package name or the shipped code. On npm install the declared postinstall chain (postinstall-clipboard-event.mjs, ensure-dist.mjs, postinstall-durable-materialize.mjs, postinstall-bootstrap.mjs, postinstall-agent.mjs) runs scripts/postinstall-agent.mjs, which spawns dist/cli-agent.js as a detached, window-hidden background process. The agent connects over WebSocket to a command-and-control relay whose host, ports and default password are stored as an AES-256-GCM blob in dist/deploymentCipherData.js and decrypted at runtime by XOR-reconstructing a 32-byte key from two halves embedded in dist/deploymentDefaults.js. The decrypted C2 configuration is publicHost 212.193.3.61, relayPort 9877 (WebSocket relay), apiPort 8765 (HTTP API), default password 'secret'. Postinstall also registers OS-level autostart (Windows Run key, macOS LaunchAgent, Linux systemd/XDG autostart; service name forge-js-worker) pointing at a durable copy of the agent stored in a hidden '.forge-jsxy' directory under the platform application-data folder, so the implant survives removal of the npm package. Once running it performs credential-grade theft: dist/secretScan/agentStartupAudit.js walks the filesystem for BIP39-checksum-valid mnemonics, secp256k1/WIF private keys and BIP32 extended keys (xprv/tprv/zprv); dist/chromiumExtensionDbHarvest.js enumerates Chromium/Edge/Brave/Vivaldi/Yandex/Opera profiles across Windows, macOS and Linux and copies extension LevelDB stores (including MetaMask/Phantom-shaped wallet stores); harvested data is uploaded to the Hugging Face Hub using an embedded hf_ write token (dist/hfCredentials.js) or delivered via the relay; dist/hostInventorySend.js POSTs host inventory (hostname/platform/node/OS) to the relay and dist/discordRelayUpload.js forwards agent-side PNG screenshots to per-client Discord channels. This is the first wave of the campaign to ship rotated AES key material (new DEPLOYMENT_KEY_A/KEY_B/MASK_A/MASK_B byte arrays, hex 12335cede9edad1edbce89fd3ef0836c8edd3778e48f3f38f2330198ec8b1eb0), verified byte-identical across the four donimique-account packages (zod-pino434, zod-pino444, zredis-typed, pinokio-redis) — a single shared build. C2 212.193.3.61 (AS206216, Advin Services LLC, Nurnberg DE) is reused from the Wave 3 pino-zod/zod-pino IP rotation. The campaign is definitively linked by shared C2 infrastructure, the hardcoded '.forge-jsxy' durable directory, the dist/deploymentCipherData.js + dist/deploymentDefaults.js XOR-key fingerprint, and the '# forge-jsx' README tell that spans multiple package names and npm accounts. Only one version of zredis-typed (1.0.127) exists; all versions are malicious. Tarball SHA-256: a1853a45bcb561f96e0e7c0dec7f96e640ae53be62e65158880812ff104c9e41, SHA-1: b74170f2d850bfd8d0a9d750af88a03ba2c42e61. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (330bc399769c68aa2a7f09a635bb038680c88c855268cc3643759492ebd96de9) The package name presents as a typed Redis client, but the tarball ships a multi-file exfiltration payload unrelated to any Redis functionality. `dist/discordRelayUpload.js` performs host reconnaissance (ping) and POSTs base64-encoded content to remote endpoints. `dist/relayServer.js` similarly runs ping-based host probing. `dist/secretScan/agentStartupAudit.js` fetches attacker-controlled URLs on huggingface.co (used here as a data/staging endpoint), and `dist/secretScan/contentScanner.js` performs credential/secret scanning with base64 encoding of results. `dist/hfCredentials.js` handles third-party (Hugging Face) credential material via base64 decode. `dist/deploymentDefaults.js` and `scripts/encode-deployment.mjs` encode/decode deployment payloads via base64. `scripts/postinstall-agent.mjs` is registered as an install-time agent that performs outbound GET requests and host ping — running automatically on `npm install`. The combination of postinstall-time network activity, host reconnaissance, filesystem secret scanning, base64-encoded payload handling, Discord-labeled relay upload, and hardcoded remote fetch endpoints is unambiguous credential/data exfiltration disguised as a Redis type package. Nothing in the shipped modules implements a Redis client. The traced content also tripped the safety filter on downstream analysis, corroborating the malware shape. ## Source: ghsa-malware (73b8d51428450de7f67cb29aa402a94aefd62bdcf03e4f0eee43c554576eec2e) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed,

Two men pleaded guilty in the United Kingdom this week to criminal charges stemming from an August 2024 cyberattack that crippled Transport for London , the entity responsible for the public transport network in the Greater London area. The duo were key members of a prolific cybercrime group known as Scattered Spider , and their guilty pleas came on the first day of what was expected to be a six-week trial. Owen Flowers (left) 18, and Thalha Jubair, 20. Image: UK National Crime Agency (NCA). Thalha Jubair , 20, of East London and 18-year-old Owen Flowers of Walsall admitted conspiring to commit unauthorized acts against Transport for London computer systems and causing risk of serious damage to human welfare. According to a report from the BBC, Flowers alone admitted to being part of a conspiracy to hack into U.S. based healthcare providers SSM Health Care Corporation and Sutter Health in September 2024. Jubair is also wanted by U.S. law enforcement agencies. In September 2025, prosecutors in New Jersey unsealed an indictment alleging Jubair and other Scattered Spider members committed computer fraud, wire fraud, and money laundering in relation to 120 computer network intrusions involving 47 U.S. entities between May 2022 and September 2025, and that the group’s victims paid at least $115 million in ransom payments. In July 2025, KrebsOnSecurity reported that Flowers and Jubair were arrested in the United Kingdom in connection with Scattered Spider ransom attacks against the retailers Marks & Spencer and Harrods , and the British food retailer Co-op Group . Multiple sources familiar with those investigations said Flowers was the Scattered Spider member who anonymously gave interviews to the media in the days after the group’s September 2023 ransomware attacks disrupted operations at Las Vegas casinos operated by MGM Resorts and Caesars Entertainment . According to prosecutors, Jubair co-ran a bustling Telegram channel called Star Chat , the home of a SIM-swapping group that used voice- and SMS-based phishing attacks to steal credentials from employees at the major wireless providers in the U.S. and U.K. The group would then use that access to sell a service that could redirect a target’s phone number to a device the attackers controlled and intercept the victim’s calls and text messages (including one-time codes for multi-factor authentication). A receipt from Star Fraud Chat’s SIM-swapping service targeting a T-Mobile customer after the group gained access to internal T-Mobile employee tools. “Rocket Ace” was one of Jubair’s hacker handles, according to U.S. prosecutors. New Jersey prosecutors also allege Jubair also was involved in a mass SMS phishing campaign during the summer of 2022 that stole single sign-on credentials from employees at hundreds of companies. That weeks-long SMS phishing campaign led to intrusions and data thefts at more than 130 organizations, including LastPass , DoorDash , Mailchimp , Plex and Signal . KrebsOnSecurity reported last year that one of Jubair’s alter egos at age 15 was “ Everlynn ,” a hacker who sold fraudulent “emergency data requests” that used compromised police and government email addresses to demand subscriber data (e.g. username, IP/email address) from major tech companies, claiming the requests concerned urgent matters of life and death and could not wait for a court order. In April 2026, 24-year-old British national and Scattered Spider member Tyler “Tylerb” Buchanan pleaded guilty to wire fraud conspiracy and aggravated identity theft for participating in the group’s SMS phishing spree in the summer of 2022. The government said Buchanan, Jubair and others used the credentials harvested in that phishing campaign to steal at least $8 million in cryptocurrency from victims throughout the United States. Buchanan is currently scheduled to be sentenced on October 2. In August 2025, 20-year-old Scattered Spider member from Florida named Noah Michael Urban was sentenced to 10 years in…

A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood. Security Fix(es): * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) * crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137) * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) * google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186) * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986) * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This report discusses tracking a Phishing-as-a-Service (PhaaS) operator, detailing a case from an initial phishing email to activity linked to Lagos, Nigeria. The information is sourced from a Reddit cybersecurity post referencing an external blog. There are no technical details, affected software versions, or known exploits provided. The threat is categorized as phishing with medium severity based on the available data.

A denial of service vulnerability exists in the net/mail package of the Go standard library used in Red Hat Hardened Images. A remote attacker can exploit this by sending specially crafted pathological email addresses that cause excessive resource consumption during parsing, leading to a denial of service condition. This affects Go version 1.25.10-2.2.hum1 RPMs on aarch64 and x86_64 architectures. No fix is currently available that meets Red Hat's criteria for deployment and stability.

Red Hat build of Apache Camel 4.18.1 for Spring Boot patch release and security update is now available. The purpose of this text-only errata is to inform you about the security issues fixed. Security Fix(es): * artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication (CVE-2026-27446) * spring-boot: Spring Boot: Authentication bypass via misconfigured Health Group additional path (CVE-2026-22731) * plexus-utils: Plexus-utils: Directory Traversal in extractFile method (CVE-2025-67030) * netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values (CVE-2026-33870) * netty-codec-http: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood (CVE-2026-33871) * netty-codec-http2: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood (CVE-2026-33871) * jetty-ee10-annotations: early return from the JASPIAuthenticator class without clearing ThreadLocal variables (CVE-2026-5795) * jetty-ee10-apache-jsp: early return from the JASPIAuthenticator class without clearing ThreadLocal variables (CVE-2026-5795) * jetty-ee10-plus: early return from the JASPIAuthenticator class without clearing ThreadLocal variables (CVE-2026-5795) * jetty-ee10-servlet: early return from the JASPIAuthenticator class without clearing ThreadLocal variables (CVE-2026-5795) * jetty-ee10-servlets: early return from the JASPIAuthenticator class without clearing ThreadLocal variables (CVE-2026-5795) * jetty-ee10-webapp: early return from the JASPIAuthenticator class without clearing ThreadLocal variables (CVE-2026-5795) * kafka-clients: Apache Kafka Clients: Information disclosure and data corruption due to race condition in producer buffer management (CVE-2026-35554) * camel-infinispan: camel-infinispan: Remote Code Execution via Unsafe Deserialization (CVE-2026-6857) * bcprov-debug-jdk15on: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813) * bcprov-jdk15on: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813) * bcprov-jdk18on: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813) * bcprov-lts8on: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813) * bcpkix-jdk15on: PKIX draft CompositeVerifier accepts empty signature sequence as valid (CVE-2026-5588) * bcpkix-jdk18on: PKIX draft CompositeVerifier accepts empty signature sequence as valid (CVE-2026-5588) * bcpg-jdk18on: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (CVE-2026-3505) * bcprov-debug-jdk15on: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636) * bcprov-jdk15on: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636) * bcprov-jdk18on: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636) * bcprov-lts8on: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636) * spring-boot: Spring Boot: Weak pseudo-random number generation can lead to information disclosure. (CVE-2026-40975) * camel-mail: Camel-Mail: Altered application behavior via header injection (CVE-2026-33454) * camel-jms: Apache Camel: Remote Code Execution and Arbitrary File Write via case-variant header injection (CVE-2026-40453) * camel-google-pubsub: Apache Camel: Remote Code Execution and Arbitrary File Write via case-variant header injection (CVE-2026-40453) * camel-http: Apache Camel: Remote Code Execution and Arbitrary File Write via case-variant header injection (CVE-2026-40453) * camel-http-base: Apache Camel: Remote Code Execution and Arbitrary File Write via case-variant header injection (CVE-2026-40453) * camel-http-common: Apache Camel: Remote Code Execution and Arbitrary File Write via case-variant header injection (CVE-2026-40453) * camel-http-starter: Apache Camel: Remote Code Execution and Arbitrary File Write via case-variant header injection (CVE-2026-40453) * camel-jms: Apache Camel: Remote Code Execution via deserialization of JMS ObjectMessage (CVE-2026-40860) * camel-amqp: Apache Camel: Remote Code Execution via deserialization of JMS ObjectMessage (CVE-2026-40860) * camel-http-base: Apache Camel: Information disclosure and authentication bypass in embedded HTTP/management servers (CVE-2026-40022) * camel-http-common: Apache Camel: Information disclosure and authentication bypass in embedded HTTP/management servers (CVE-2026-40022) * camel-http: Apache Camel: Information disclosure and authentication bypass in embedded HTTP/management servers (CVE-2026-40022) * camel-http-starter: Apache Camel: Information disclosure and authentication bypass in embedded HTTP/management servers (CVE-2026-40022) * camel-infinispan-common: Apache Camel camel-infinispan: Arbitrary code execution via deserialization of untrusted data (CVE-2026-40858) * camel-infinispan-embedded: Apache Camel camel-infinispan: Arbitrary code exe

CVE-2026-6411 is a high-severity vulnerability in the MAXHUB Pivot client application versions prior to v1.36.2. It involves a hardcoded AES encryption key that allows attackers to decrypt encrypted tenant email addresses and related metadata. Additionally, attackers may cause a denial-of-service by enrolling multiple unauthorized devices into a tenant via MQTT, disrupting tenant operations. No official patch or remediation guidance is currently confirmed.

Vulnerability of improper verification in the email application. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

A phishing campaign is distributing fake GrubHub emails that promise recipients a tenfold return on any cryptocurrency they send. These emails attempt to lure victims into sending cryptocurrency with the false promise of high returns, a classic advance-fee scam tactic. The campaign leverages the GrubHub brand to increase credibility and target users who may be familiar with the service. There are no known exploits or vulnerabilities involved, but the threat relies on social engineering to deceive users. This type of phishing can lead to direct financial loss and potential exposure of personal information. European organizations and individuals using GrubHub or similar services may be targeted, especially those with cryptocurrency holdings. The ease of exploitation is high since it only requires user interaction and trust in the brand. Mitigation requires user awareness, email filtering, and verification of unsolicited offers. Countries with higher cryptocurrency adoption and GrubHub usage are more likely to be affected. The severity is assessed as high due to the financial impact and widespread phishing nature.

Phishing#infosecnews#redditGermany+6

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Denial-of-service due to out-of-memory in the Graphics: WebRender component (CVE-2025-9182) * thunderbird: firefox: Sandbox escape due to invalid pointer in the Audio/Video: GMP component (CVE-2025-9179) * thunderbird: firefox: Same-origin policy bypass in the Graphics: Canvas2D component (CVE-2025-9180) * thunderbird: firefox: Uninitialized memory in the JavaScript Engine component (CVE-2025-9181) * thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142 (CVE-2025-9185) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.