Threats tagged 'java'

CVE-2026-119117 is a vulnerability in the Amazon Kinesis Producer Library for Java versions before 1.0.8 and up to 0.15.12, where sensitive AWS credentials may be exposed. When the library's logger is set to DEBUG level, these credentials can be written into log files. Additionally, the credentials are passed as command-line arguments to native child processes, making them accessible to local users via the process argument list.

Microsoft Threat Intelligence analyzed two human-operated intrusion cases where attackers used Microsoft Teams to impersonate IT support and socially engineer users into granting remote access via Quick Assist. The attackers then staged portable runtimes, performed host and network discovery, and abused Active Directory Certificate Services (AD CS) to obtain authentication certificates for privileged accounts. Two distinct AD CS abuse techniques were observed: ESC1 template abuse allowing certificate issuance for privileged accounts, and ESC8 NTLM relay to AD CS Web Enrollment to obtain domain-controller certificates. These certificate-based authentications enabled persistent privileged access independent of passwords. The incidents highlight risks from social engineering combined with insecure or overly permissive AD CS configurations rather than software vulnerabilities. Microsoft Defender detections and containment effectiveness varied between cases, influencing the extent of attacker progression.

This report summarizes multiple cyber threats and incidents observed in late October 2026, including large-scale breaches, supply-chain attacks, AI-enabled cybercrime tools, and critical software vulnerabilities. Notable incidents include a cyberattack on Japanese cloud provider Onamae Desktop Cloud affecting over 26,000 servers, a data breach at India's State Bank of India exposing nearly 3,900 customer records, and a supply-chain compromise of the LiteLLM AI gateway. AI-enabled tools are facilitating large-scale fraud and ransomware attacks targeting critical sectors in the United States. Critical PHP vulnerabilities enabling remote code execution are being widely exploited, with most instances unpatched. Oracle and GitLab have released patches for numerous critical vulnerabilities, including a critical remote code execution flaw in GitLab and a privilege escalation vulnerability in Arista VeloCloud Orchestrator that has been exploited in the wild.

Two critical PHP remote code execution vulnerabilities will be patched in an emergency release on October 21. Fixes are only expected for supported PHP 8.x branches. Key takeaways CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP, both rated CVSSv4.0 9.2 by the PHP security team. Public reporting describes both as remote code execution vulnerabilities. watchTowr says it believes it has reproduced CVE-2026-109618, and Cloudflare CTO Dane Knecht says the company is seeing early attacks emerging. The patch release is scheduled for October 21, 2026 at 14:00 UTC. Version numbers reported before the release point to PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. End-of-life branches are not expected to receive fixes. Background Tenable's Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding two critical vulnerabilities in PHP that were announced on October 20, 2026. FAQ When were these PHP vulnerabilities first disclosed? On October 20, 2026, the CVE identifiers circulated on Hacker News and social media. Later that day, the PHP security team published an advance notice of a security release scheduled for October 21 at 14:00 UTC (10:00 AM ET) to address two critical vulnerabilities. The notice said the team could release earlier if details became public or if exploitation appeared in the wild. CERT-EU also published an advisory (2026-018) naming both CVEs. According to watchTowr , the vulnerabilities were originally set to be disclosed on Thursday, October 22, under embargo. A video shared by researcher Kirill Firsov demonstrates the exploit chain, dubbed php2shell. Firsov credited the video and exploit to researcher LCFR and Calif.io. The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence. — The PHP Foundation (@ThePHPF) October 20, 2026 What are CVE-2026-109618 and CVE-2026-109619? CVE Description CVSSv4.0 CVE-2026-109618 Unspecified PHP Vulnerability 9.2 CVE-2026-109619 Unspecified PHP Vulnerability 9.2 CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP. Public reporting describes both as remote code execution vulnerabilities. The PHP security team has not published technical details before the patch release. CVSS scores differ across sources. The PHP security team rates both vulnerabilities as CVSSv4.0 9.2. Some early reports, including watchTowr and a Hacker News post, describe them as CVSS 10.0. We will update this blog once PHP publishes its advisory. Which PHP versions are affected? CERT-EU says these vulnerabilities could affect all PHP versions from PHP 5 onwards, and the demonstration video references PHP 5.4.0 and later. PHP will publish the official list of affected and fixed versions with the release. Before the release, security researcher Kevin Beaumont reported the following fixed versions: Affected Versions Fixed Version (expected) PHP 8.5.x 8.5.12 PHP 8.4.x 8.4.27 PHP 8.3.x 8.3.36 PHP 8.2.x 8.2.35 PHP 5.x through 8.1.x End-of-life, no fix expected Linux distributions that ship older PHP packages may backport fixes, so organizations using distribution packages should check their vendor's advisories. How widespread is PHP, and how many hosts are potentially affected? According to W3Techs , PHP is used by 69.3% of websites whose server-side language is known. Platforms such as WordPress, Drupal, Joomla, Laravel and Magento all run on PHP. Security researcher Silas Cutler's rough estimate is that over 1.3 million internet-exposed hosts are potentially vulnerable. A Shodan search by Henk Poley counts over 1.9 million internet-exposed hosts running PHP. Has exploitation been observed in the wild? On October 21, Cloudflare CTO Dane Knecht said the company is "seeing early attacks emerging" and is updating its miti…

Oracle released its October 2026 Critical Patch Update (CPU), addressing 1209 unique CVEs with 1295 security patches across 33 product families. Among these, 112 patches address critical severity issues. Oracle Fusion Middleware received the highest number of patches. Many vulnerabilities can be exploited remotely without authentication. Customers are advised to apply all relevant patches from this CPU.

Bulletin ID: 2026-051-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/01/2026 12:45 PM PDT Description: The AWS Advanced JDBC Wrapper is an open-source JDBC driver wrapper that extends a JDBC driver to enable Amazon Aurora and AWS Cloud features such as failover handling and caching. We identified CVE-2026-14265, an issue in the RemoteQueryCachePlugin of the AWS Advanced JDBC Wrapper. When this plugin is enabled, query results read from the shared Redis/Valkey cache are deserialized without class filtering. An actor with write access to the shared cache infrastructure could insert a crafted serialized Java object that, when read by an application, results in execution of arbitrary code on the application server. Impacted versions: >=3.3.0 AND <=4.0.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

Oracle released its September 2026 Critical Security Patch Update (CSPU) addressing 672 unique CVEs with 673 patches across 17 product families. The update includes 104 critical severity patches and 503 high severity patches. Oracle E-Business Suite received the highest number of patches (159), followed by Oracle Fusion Middleware (153). Several vulnerabilities can be exploited remotely without authentication. Patches are available in the official advisory.

CVE-2026-85228 is an integer overflow vulnerability in the tensor buffer validation component of the Deep Java Library (DJL), an open-source Java framework for deep learning maintained by Amazon. The flaw occurs when a crafted tensor payload declares a shape whose computed byte size exceeds the 32-bit signed integer range, causing the size to wrap and allowing an undersized buffer to pass validation. This leads to out-of-bounds reads during tensor operations. Exploitation could allow a remote, unauthenticated attacker to access adjacent process memory or cause a denial of service. A fix has been released in DJL version 0.37.0. Users are advised to upgrade to this version or later. No workaround other than upgrading is available, but limiting tensor input to trusted sources can reduce risk until patched.

CVE-2026-85786 is a memory-amplification denial of service vulnerability in the Amazon ion-java library. It arises from an incomplete fix for a previous vulnerability (CVE-2026-75936) related to GZIP auto-decompression. The issue allows denial of service via highly compressed data expansion. Versions of ion-java prior to 1.12.1 are affected. The vulnerability has been addressed in ion-java version 1.12.1, and no workarounds are available.

CVE-2026-85656 is an OS command injection vulnerability in the Amazon log4j-cve-2021-44228-hotpatch tool for Amazon Linux. This tool injects a Java agent into running JVM processes to patch the Log4j CVE-2021-44228 vulnerability without restarting the process. The flaw allows a local user to execute arbitrary commands with root privileges if the Java process executable path contains embedded newline characters. Versions up to and including 1.3-8.amzn2 are affected. The issue is fixed in version 1.3-9.amzn2.

CVE-2026-83497 is a vulnerability in the OpenSearch SQL Plugin that allows a remote authenticated user with basic read/search permissions to execute arbitrary code on the server by supplying a crafted cursor parameter to the plugins/sql endpoint. This issue affects both the open-source self-managed OpenSearch SQL Plugin versions 2.8 through 3.6 and the Amazon OpenSearch Service managed versions 2.9 through 3.5. The vulnerability is addressed in OpenSearch SQL Plugin versions 2.19.6 and 3.7, and in the Amazon OpenSearch Service via service software updates for affected versions 2.9 to 3.5. No workarounds are available, and users are advised to upgrade or apply the managed service update promptly.

Oracle released its August 2026 Critical Security Patch Update (CSPU) addressing 925 unique CVEs with 943 patches across 23 product families. This update includes 154 critical severity patches, representing 16.3% of all patches, with Oracle Fusion Middleware receiving the highest number of patches at 262. The CSPU is part of Oracle's monthly patch cycle introduced in May 2026 to address high-severity issues more rapidly. Many vulnerabilities can be exploited remotely without authentication. Patches for all affected products are available in the official August 2026 advisory.

A custom Java web shell likely linked to the Clop ransomware gang was designed specifically for PTC Windchill and FlexPLM servers, with built-in features to decrypt credentials, enumerate file repositories, and steal files. [...]

Files built with the polyglot technique have been showing up more and more in cyberattacks in recent years. They let attackers slip malware past email filters and file scanners, deceive victims in phishing attacks, and complicate incident investigations. To pull this off, attackers deliberately construct a file that a system can interpret as different formats depending on which application opens it. A classic example is a file that can be handled as a PNG image or a ZIP archive. All it takes is changing the file’s extension, or simply using one or another application to open it. Let’s take a look at why it’s even possible to create files like this, which format combinations have turned up in real-world attacks, and how organizations can protect themselves from this threat. Why polyglot files are possible The data formats behind polyglot files are seldom exotic. It all comes down to a clever combination of common formats that happen to be structurally compatible. Polyglots exploit at least one of the following quirks in certain file formats: Most file formats need decoding from the very first byte, but some require to read them from the end. The clearest example is a ZIP archive: a corrupted or missing beginning doesn’t stop applications from reading the file, because all the needed headers actually sit at the end. This lets attackers simply glue two files together — in the example above, a PNG and a ZIP. The beginning reads as a valid PNG image, while the end reads as a valid ZIP archive. Many formats work like Russian matryoshka nesting dolls: despite outwardly having a specific extension matching its intended usage, inside the file is essentially a ZIP archive containing the necessary data. This group includes modern office documents (DOCX/XLSX/PPTX), Android installation packages (APK), Java library files (JAR), and many others. Some formats have no strict structural requirements — or their requirements are loose enough that the application that’s processing the file can locate the fragment it needs even when that fragment isn’t at the beginning. The Polydet GitHub repository describes numerous examples of possible file combinations for building a polyglot. Under the MITRE classification, this technique falls under the Masquerading category ( T1036.008 , Masquerade File Type). Examples of polyglot files in known cyberattacks Publicly available malware campaign analyses reveal all kinds of polyglots. Attackers adapt the entire attack scenario to fit a specific file type combination. The Head Mare group delivered the PhantomPyramid malware as a ZIP attachment. The file consisted of Windows executable code (EXE) with a small ZIP archive glued onto the end. When the victim opened the archive, it contained a file with the extension PDF.LNK, which would then launch that same polyglot attachment — this time as an executable file. In the attack documented by JPCERT , attackers created a file that started as a PDF and was detected as a PDF by most scanners but carried a DOC extension and opened in Office applications as a valid DOC file containing malicious macros. The attacks spreading the StrRAT and Ratty Trojans used a polyglot built from a signed Windows installer package (MSI) with malicious Java code (JAR) tacked onto the end. The StrelaStealer attacks used a polyglot with an HTML extension: a Windows library (DLL) with a decoy HTML document glued onto the end. A shortcut in the archive launched the file twice: once via the start command (the equivalent of a double-click, which opened a browser showing the HTML document), and once via rundll32 (which launched the malicious DLL). In a simulated but elegant attack, researchers joined two ordinary ZIP files together and found that different popular archive tools displayed the combined file differently: some showed only the first archive, some only the second, and some showed both at once as if it were a single archive with shared contents. If the attacker is familiar with the vic…

Hackers are actively exploiting a vulnerability in the FastJson open-source Java library, allowing remote code execution without user interaction or elevated privileges. [...]

Spring Boot exposes the endpoint "/actuator/heapdump" to collect debug information. By default, the endpoint will return a file heapdump.hprof, which includes a binary heapdump that can be used to analyze the current state of the application. Non-Java readers may be familiar with a similar concept, core dumps, which are produced by binaries to expose a memory image at the time the software crashes. "heapdumps" are the Java analog to "core-dumps". The heapdump often includes secrets used by the application to connect to backend systems. API keys, database passwords, and other sensitive data may be exposed in the heapdump.&#xd;

A large malvertising campaign uses fake Solana, Luno, and TradingView websites with malicious JavaScript that assembles malware directly in browser memory. The attack uses service workers and shared workers to build a unique malware executable locally, avoiding transmission of a complete file over the network. This technique helps evade static detection and complicates analysis. The campaign targets retail traders and crypto investors primarily in Asia Pacific and Latin America. The malware reportedly can intercept network traffic, steal credentials and cryptocurrency wallet data, record keystrokes, take screenshots, and maintain persistence. Users are advised to download financial software only from official sources and verify digital signatures.

Unit 42 details a Russian cyberespionage campaign targeting Zimbra webmail servers using JavaScript injection to steal credentials. The post Russian Global Webmail Espionage appeared first on Unit 42 .

Campaign#web#javaUkraine

Oracle addresses 1235 CVEs in its third quarterly update of 2026 with 1449 patches, including 261 critical updates. Key Takeaways The third Critical Patch Update (CPU) for 2026 contains fixes for 1235 unique CVEs in 1449 security updates, the largest CPU release. 261 issues (18% of all patches) were assigned a critical severity rating Oracle E-Business Suite received the highest number of patches at 410, accounting for 28.3% of all patches Background On July 21, Oracle released its Critical Patch Update (CPU) for July 2026 , the third quarterly update of the year. This CPU contains fixes for 1235 unique CVEs in 1449 security updates across 32 Oracle product families. Out of the 1449 security updates published this quarter, 18% of patches were assigned a critical severity. High severity patches accounted for the bulk of security patches at 52.7%, followed by medium severity patches at 24.7%. This quarter's update includes 261 critical patches across 228 CVEs. Severity Issues Patched CVEs Critical 261 228 High 763 613 Medium 358 332 Low 67 62 Total 1449 1235 Analysis This quarter, the Oracle E-Business Suite product family contained the highest number of patches at 410, accounting for 28.3% of the total patches, followed by Oracle Fusion Middleware at 355 patches, which accounted for 24.5% of the total patches. A full breakdown of the patches for this quarter can be seen in the following table, which also includes a count of vulnerabilities that can be exploited over a network without authentication. Oracle Product Family Number of Patches Remote Exploit without Auth Oracle E-Business Suite 410 45 Oracle Fusion Middleware 355 219 Oracle Communications 168 122 Oracle PeopleSoft 84 45 Oracle MySQL 54 9 Oracle Siebel CRM 45 32 Oracle Commerce 39 26 Oracle Supply Chain 39 16 Oracle Financial Services Applications 31 26 Oracle GoldenGate 27 9 Oracle Enterprise Manager 27 13 Oracle Retail Applications 22 20 Oracle JD Edwards 20 4 Oracle Java SE 19 17 Oracle Virtualization 16 0 Oracle Database Server 15 6 Oracle TimesTen In-Memory Database 14 4 Oracle Utilities Applications 14 10 Oracle Construction and Engineering 7 7 Oracle Analytics 7 5 Oracle Systems 6 0 Oracle SQL Developer 5 5 Oracle Autonomous Health Framework 4 3 Oracle Application Testing Suite 4 4 Oracle Food and Beverage Applications 4 4 Oracle HealthCare Applications 4 4 Oracle APEX 3 2 Oracle Hospitality Applications 2 2 Oracle Essbase 1 1 Oracle Global Lifecycle Management 1 1 Oracle NoSQL Database 1 1 Oracle Spatial Studio 1 1 Solution Customers are advised to apply all relevant patches in this quarter's CPU. Please refer to the July 2026 advisory for full details. Identifying affected systems A list of Tenable plugins to identify these vulnerabilities will appear here as they're released. This link uses a search filter to ensure that all matching plugin coverage will appear as it is released. Get more information Oracle Critical Patch Update Advisory - July 2026 Oracle July 2026 Critical Patch Update Risk Matrices Oracle Advisory to CVE Map Join Tenable's Research Special Operations (RSO) Team on Tenable Connect for further discussions on the latest cyber threats. Learn more about Tenable One , the Exposure Management Platform for the modern attack surface.