Threat Intelligence Database

Government agencies from the US and 13 allied countries have updated guidance on the minimum elements of a software bill of materials (SBOM). This update reflects changes in software supply chain security and transparency since the initial 2021 guidance. The refreshed guidance introduces new elements, removes some, and updates terminology to improve data quality and support broader use cases. It aims to help organizations better understand their software supply chains and manage risks related to software components. The update applies broadly to all software, with notes that AI systems and SaaS may require additional elements. This is a guidance update rather than a direct vulnerability or exploit.

CVE-2026-18353 is a Server-Side Request Forgery (SSRF) vulnerability in Eclipse Foundation's Eclipse CSI - PIA component. The vulnerability arises from the `POST /v1/upload/sbom` endpoint, which accepts a Bearer JWT and checks its unverified `iss` claim against an issuer allowlist using Python's `urlparse`. Due to inconsistent parsing of backslash characters in URLs between `urlparse` and the HTTP client libraries (`requests` and `urllib3`), an attacker can craft a malicious issuer string that bypasses the allowlist check but causes the server to make requests to attacker-controlled hosts. This can lead to unauthorized internal or external network requests initiated by the server.

A legal case involving a traveler who allegedly used a 'duress password' on a GrapheneOS phone to wipe data during a Customs and Border Protection (CBP) search at a US airport. The incident raises complex legal questions about the use of duress passwords, warrantless device searches at ports of entry, and constitutional protections. The traveler was charged with a felony for wiping his phone, which CBP alleges destroyed evidence. The case highlights ongoing debates about privacy rights, government surveillance of activists, and the legality of device searches without warrants at US borders.

This is a tutorial-style demonstration of exploiting a binary vulnerability caused by incorrect handling of the order of operations in code. It is presented as an educational resource for exploit development, focusing on a specific type of bug in a pwnable challenge binary. No specific software product or version is identified as affected. The content is primarily instructional and does not describe an active, widespread threat or vulnerability with known exploits in the wild.

Google released Chrome version 151.0.7922.71/.72 to address 370 security vulnerabilities, including seven critical-severity bugs. The update fixes multiple use-after-free issues, insufficient validation of untrusted input, race conditions, and other high-severity flaws affecting various components such as Compositing, Views, Skia, Ozone, Dawn, ANGLE, and Updater. The patch also resolves numerous medium- and low-severity security defects. This release is part of Google's ongoing effort to improve Chrome security, having fixed over 1,800 vulnerabilities earlier in the year.

The "Global" ransomware group is a ransomware-as-a-service (RaaS) operation first publicly identified in June 2025. It appears to be a rebrand or continuation of the BlackLock ransomware group, sharing infrastructure and malware characteristics. The group operates a mature affiliate program with advanced features such as AI-assisted victim communications and offers up to 85% revenue share to affiliates. Their malware targets multiple platforms including Windows, Linux, ESXi, and NAS devices, using ChaCha20-Poly1305 encryption. They also deploy a custom stealer called WorldThief to facilitate double extortion. The group relies on purchased access through compromised credentials and exploited edge devices from vendors like Fortinet, Palo Alto, and Cisco. Their operations have been observed in over 18 countries. An operational security lapse exposed a backend IP linked to a Russian VPS provider, also associated with BlackLock. This case illustrates how ransomware groups recycle infrastructure and tooling across rebrands.

CVE-2026-7849 is a critical command injection vulnerability in Phoenix Contact CHARX SEC-3150 version 1.0.0. An unauthenticated remote attacker can inject commands into the system configuration, which are executed with root privileges due to improper neutralization of special elements. This allows full system compromise without any authentication or user interaction.

CVE-2026-44108 is a critical vulnerability in the Phoenix Contact CHARX SEC-3150 device. It arises from an incorrect execution order of shutdown scripts, causing the firewall to terminate prematurely during system shutdown. This flaw creates a temporary window where internal services may be exposed externally, allowing unauthenticated remote attackers to connect and potentially achieve full system compromise. The vulnerability affects version 1.0.0 of the product. No official patch or remediation guidance has been provided yet.

CVE-2026-44107 is a high-severity vulnerability in the Phoenix Contact CHARX SEC-3150 charging controller. It allows an unauthenticated attacker to trigger a reboot of the device via Modbus TCP when the Modbus service is enabled and its listening port is open. This results in a denial-of-service condition. The vulnerability affects version 1.0.0 of the product. No official patch or remediation has been confirmed yet.

CVE-2026-44106 is a privilege escalation vulnerability in the init-script for user-applications on Phoenix Contact CHARX SEC-3150 version 1.0.0. It allows a low-privileged local user to execute arbitrary commands as root, leading to full system compromise. The vulnerability is classified as an OS command injection (CWE-78). The CVSS 4.0 base score is 8.5, indicating high severity. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.