Threats tagged 'remote'

A critical remote code execution vulnerability exists in Cisco Snort's sf_unfold_header component. This flaw allows unauthenticated remote attackers to execute arbitrary code on affected systems. The vulnerability has been assigned CVE-2026-20043 and carries a high severity rating of 9.8 by the Zero Day Initiative.

This analysis from Microsoft Security Research examines the characteristics of software vulnerabilities that have been exploited in real-world attacks. Out of approximately 383,000 disclosed vulnerabilities through September 2026, only about 2,000 (0.5%) have been linked to actual exploitation. Exploited vulnerabilities disproportionately enable system takeover, such as remote code execution (RCE), privilege escalation, and authentication bypass. The study classifies vulnerabilities by impact and platform, highlighting that exploitation is concentrated in vulnerabilities that provide attackers with significant control. Patching remains critical but is often slow, necessitating focused defensive efforts on high-impact vulnerabilities.

This report summarizes multiple significant cyber threats and incidents disclosed in early November 2026. Major breaches include a $6.3 billion cryptocurrency theft from Binance via compromised internal infrastructure, a malicious JavaScript attack on Polymarket's platform, and data breaches affecting Japan Airlines and the Florida Department of Education. The report also highlights the use of AI by threat actors such as the GOLD OGRE ransomware group and North Korean cyber operators to enhance attack capabilities. Several critical vulnerabilities are noted, including CVE-2026-111497 (HTTP2Shell) affecting Brotli decompression, a critical Linux kernel TCP networking flaw (CVE-2026-98432), and a Drupal Commerce Core access control vulnerability (CVE-2026-118539). Cisco patched a high-severity SSL VPN crash vulnerability (CVE-2026-76418) that was exploited in the wild. Additional threat intelligence includes malware campaigns and advanced persistent threat activity targeting various sectors globally.

INFINITT PACS System Manager versions 3.0.11.3 and 3.0.11.5 contain multiple code execution vulnerabilities. CVE-2026-16305 allows a local low-privileged attacker to execute arbitrary commands with administrative privileges due to insecure file permissions on an update manifest file. CVE-2026-16306 allows remote code execution via a crafted imodular:// URI scheme that executes unsafe commands without proper validation. Both vulnerabilities have been fixed in versions 3.0.12.3 and 3.0.12.5.

A remote code execution vulnerability exists in Microsoft Qlib's StaticDataLoader component. Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file. The vulnerability allows remote attackers to execute arbitrary code on affected systems.

A remote code execution vulnerability exists in Microsoft Qlib due to unsafe deserialization in the RestrictedUnpickler component. Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file. The vulnerability has a high severity rating with a CVSS score assigned by ZDI as 7.8.

A remote code execution vulnerability exists in Microsoft Qlib's MLflowRecorder component due to deserialization of untrusted data. Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file. The vulnerability has a high severity rating of 7.8 assigned by ZDI.

CVE-2026-98432 is a memory corruption vulnerability in the Linux kernel's IPv4 TCP handshake path affecting kernel versions 4.4 and later. This flaw could lead to remote code execution. AWS has released updated kernel packages for Amazon Linux 2 and Amazon Linux 2023 to address this issue. Customers running self-managed Linux instances are advised to update and reboot their systems. AWS-managed services are being updated by AWS with no customer action required.

A malicious version of the Claude Code extension (versions 2.1.312 and 2.1.313) was briefly available on the Cursor marketplace, embedding a JavaScript loader that attempts to establish persistent SSH backdoor access. The loader collects host information, adds an attacker-controlled SSH public key to authorized_keys, enables the local SSH service, creates a reverse SSH tunnel, configures persistence mechanisms, and attempts to exfiltrate host details. The incident is limited to the Cursor marketplace; official Microsoft Visual Studio Marketplace and npm packages were not affected. Successful remote access depends on host privileges and SSH configuration. Organizations should identify affected systems, preserve evidence, remove malicious artifacts, and rotate credentials if exposure is suspected.

Microsoft Threat Intelligence analyzed two human-operated intrusion cases where attackers used Microsoft Teams to impersonate IT support and socially engineer users into granting remote access via Quick Assist. The attackers then staged portable runtimes, performed host and network discovery, and abused Active Directory Certificate Services (AD CS) to obtain authentication certificates for privileged accounts. Two distinct AD CS abuse techniques were observed: ESC1 template abuse allowing certificate issuance for privileged accounts, and ESC8 NTLM relay to AD CS Web Enrollment to obtain domain-controller certificates. These certificate-based authentications enabled persistent privileged access independent of passwords. The incidents highlight risks from social engineering combined with insecure or overly permissive AD CS configurations rather than software vulnerabilities. Microsoft Defender detections and containment effectiveness varied between cases, influencing the extent of attacker progression.

A high-severity unauthenticated race condition vulnerability in WordPress's Core update process allows remote code execution. The flaw arises from predictable, web-accessible staging directories during updates, enabling attackers to exploit a narrow time window while WordPress unpacks updates. WordPress 7.1.4 and earlier branches have been patched to randomize staging directories and prevent unsafe configuration promotion. Exploitation attempts began shortly after patch release, but no successful compromises have been reported.

php2shell comprises two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution. Exploitation requires tailoring the attack to the specific PHP environment, making widespread mass exploitation difficult. However, network appliances running identical builds are vulnerable to a single calibrated exploit. Exploitation has been confirmed in the wild, including attacks on PAN-OS firewall management servers. Patching is available and strongly recommended, especially for internet-facing management interfaces and end-of-life PHP versions.

NIK C2 is a newly observed AI-enabled command-and-control (C2) framework targeting Windows systems. It features a Go-based implant that provides persistent remote access with capabilities including credential dumping, keystroke streaming, RDP session hijacking, process hollowing, and deployment of screen-locking ransomware demanding cryptocurrency payments. The implant uniquely integrates the OpenAI Chat Completions API, allowing threat actors to analyze harvested data using AI in real time within the compromised session. This integration collapses traditional offline data processing delays, complicating detection and response efforts. The implant communicates over encrypted channels with resilient fallback mechanisms and has been observed in multiple evolving versions compiled no earlier than late 2024. Active infrastructure associated with NIK C2 has been identified in the wild, confirming its operational status.

CVE-2026-76418 is a high-severity vulnerability in Cisco Secure Firewall ASA and FTD software affecting the Remote Access SSL VPN service. It allows unauthenticated remote attackers to cause the firewall device to restart unexpectedly, disrupting availability. The flaw stems from logic errors in tunnel groups configured with secondary authentication. Cisco has released patches to fix this issue and recommends upgrading. No workarounds exist, though disabling secondary authentication or tunnel group lists can reduce exposure but weaken security. This is the second zero-day exploited in Cisco ASA and FTD VPN services in recent months.

A remote code execution vulnerability exists in MLflow's PickleEvaluationArtifact deserialization process. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. The vulnerability has a high severity rating of 7.8 assigned by ZDI and is tracked as CVE-2026-118623.

A remote code execution vulnerability exists in MLflow's SHAP load_explainer functionality. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. The vulnerability has a high severity rating assigned by ZDI with a CVSS score of 7.8.

A remote code execution vulnerability exists in MLflow's Statsmodels _load_model function. Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file. The vulnerability is assigned CVE-2024-37052 and has a high severity rating by ZDI with a CVSS score of 7.8.

CVE-2026-101767 is a critical unauthenticated SQL injection vulnerability in Oracle E-Business Suite's Application Object Library. It allows remote attackers to execute arbitrary code and fully compromise the affected component. The flaw was patched in Oracle's October 2026 CPU, and exploitation attempts were observed shortly after the patch release.

A type confusion vulnerability in Apple Safari's jsToWasm IC entrypoint allows remote attackers to execute arbitrary code. Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file. The vulnerability is assigned CVE-2026-86974 with a high severity rating of 8.8 by ZDI.