Threats Tagged 'remote'

A malware campaign is targeting WhatsApp users globally by sending deceptive VBScript files disguised as business and financial documents from compromised contacts. When executed on Windows, the VBScript disables User Account Control (UAC) protections and silently installs ManageEngine Endpoint Central software configured to connect to attacker-controlled servers, granting remote access to the victim's PC. The campaign affects multiple countries and uses localized filenames to increase effectiveness. The exact method of WhatsApp account compromise is unknown. Users are advised to verify files received via WhatsApp and scan them before execution.

MediumMalwareBrazilIndiaMexico+8#remote

The PixelSmash vulnerability (CVE-2026-8461) is a heap out-of-bounds write flaw in the MagicYUV decoder of FFmpeg's libavcodec library. It affects video files in AVI, MKV, and MOV formats and can be triggered by opening or scanning such files. This flaw can cause denial-of-service conditions in multiple media applications and potentially enable remote code execution (RCE) on Jellyfin and Nextcloud servers under specific conditions. Exploitation for RCE requires Address Space Layout Randomization (ASLR) to be disabled or chained with another vulnerability to bypass this protection. FFmpeg version 8.1.2 addresses this issue, and some applications have implemented mitigations such as disabling vulnerable decoders or adding file format blocklists.

AutoJack is a novel exploit chain showing how a single malicious webpage can turn an AI browsing agent into a remote code execution vector on the host machine. By abusing trust in localhost, missing authentication, and unsafe parameter handling, attackers can trigger arbitrary process execution through AutoGen Studio’s MCP WebSocket. The research highlights a broader pattern - when agents can browse untrusted content and access local services, traditional boundaries like localhost are no longer secure. The post AutoJack: How a single page can RCE the host running your AI agent appeared first on Microsoft Security Blog .

CryptoBandits uses a local SOCKS5 proxy for traffic routing, blending data theft with remote code execution. The post CryptoBandits Malware Doubles as a Backdoor, Abuses Tor appeared first on SecurityWeek .

Critical flaws in NGINX could allow remote, unauthenticated attackers to cause a restart and potentially execute arbitrary code. The post F5 Patches Critical, High-Severity NGINX Vulnerabilities appeared first on SecurityWeek .

Microsoft - NTLMv2 Hash Capture

Grav CMS 2.0.0-beta.2 - Remote Code Execution

scramble - Remote Code Execution

MixPHP Framework 2.2.17 - Unsafe Deserialization Remote Code Execution

Quick Playground for WordPress 1.3.1 - Unauthenticated Remote Code Execution