Skip to content

Security Sense

AI Threat Intelligence

  • About
  • Blog
  • Privacy Policy

Tag: vulnerability

Apple Zero-Day Vulnerability CVE-2026-86950 Weaponized in Targeted Attacks

Posted on September 30, 2026 by Kyle

Overview

Apple has acknowledged active exploitation of CVE-2026-86950, an out-of-bounds write vulnerability, in targeted attacks. This zero-day flaw is being leveraged by threat actors in a highly sophisticated manner. The vulnerability poses a critical risk to affected Apple devices, necessitating immediate patching upon release.

Technical Analysis

CVE-2026-86950 is described as an out-of-bounds write vulnerability. Specific details regarding the affected component, attack vector, and prerequisites for exploitation are not publicly available at the time of writing, as Apple has only confirmed its active exploitation and nature of the flaw. The “out-of-bounds write” typically implies that an attacker can write data outside of an allocated memory buffer, potentially leading to arbitrary code execution or denial of service. Apple states the attacks are “extremely sophisticated.”

Detection

Due to the limited public details about CVE-2026-86950 and its exploitation, specific detection mechanisms are challenging to define.
* Monitor for unusual process behavior or unexpected network connections originating from Apple devices, particularly those running older, unpatched versions.
* Review device logs (e.g., unified logs on macOS/iOS) for crashes, unexpected reboots, or suspicious system calls that might indicate exploit attempts or post-exploitation activity.
* Look for signs of privilege escalation or persistence mechanisms being established on compromised systems.
* Note: Without specific process names, file paths, or network indicators, concrete detection rules cannot be provided at this time.

Mitigations

  1. Apply security updates from Apple immediately upon their release. This is the primary and most effective mitigation for zero-day vulnerabilities.
  2. Ensure all Apple devices (iOS, macOS, watchOS, tvOS, visionOS) are kept up-to-date with the latest software versions.
  3. Implement robust endpoint detection and response (EDR) solutions on macOS devices to monitor for post-exploitation activities.
  4. Educate users about phishing and social engineering tactics, as these are common initial access vectors for targeted attacks.
  5. Restrict unnecessary network access and enforce the principle of least privilege for all users and applications.

References

  • https://www.darkreading.com/cyberattacks-data-breaches/apple-zero-day-vulnerability-weaponized-targeted-attacks

Indicators of Compromise

No public IOCs available at time of writing.

🤖 AI Attribution
Generated by gemini-2.5-flash ·
1,487 input / 708 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in cveTagged apple, critical, vulnerability, zero-dayLeave a comment

TDengine Zero-Day Vulnerability: Single-Packet DoS

Posted on September 28, 2026 by Kyle

Overview

A high-severity zero-day vulnerability has been identified in the TDengine time-series database. This flaw allows an unauthenticated attacker to trigger a Denial of Service (DoS) condition by sending a single, specially crafted network packet to a vulnerable server. Organizations in industrial, IoT, energy, and automotive sectors utilizing TDengine are at risk, as successful exploitation can lead to the abrupt crash of critical operational technology (OT) servers.

Technical Analysis

  • Vulnerability Type: Zero-day Denial of Service (DoS).
  • Affected Product: TDengine time-series database.
  • Affected Versions: Specific affected versions are not publicly detailed at the time of writing, but as a zero-day, it is presumed to impact current and recent versions until a patch is released.
  • Attack Vector: Network-based. An unauthenticated attacker can exploit this vulnerability by sending a single malformed packet to the TDengine server’s listening port (default 6030/TCP).
  • Impact: Successful exploitation results in the immediate crash of the TDengine server process, leading to a complete Denial of Service for any applications relying on the database.
  • Prerequisites: Direct network access to the TDengine server’s listening port.

Detection

  • Network Monitoring: Look for unusual or malformed network traffic directed at TDengine server ports (e.g., 6030/TCP). While specific packet signatures are unknown, an IDS/IPS might flag anomalous packet structures.
  • Host-Based Logging: Monitor TDengine server hosts for unexpected process terminations of the taosd process. Look for non-zero exit codes or service failures not associated with planned shutdowns.
  • System Logs: Review system logs (e.g., syslog, journalctl on Linux, Event Logs on Windows) for entries indicating crashes, core dumps, or service failures related to taosd.
  • Application Logs: Check TDengine’s own logs for critical error messages immediately preceding a server crash.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

TDengine Server Unexpected Process Termination

title: TDengine Server Unexpected Process Termination
id: 88c2b1e0-a1f2-4c3e-8b1e-f1c2b3e4a5d6
status: experimental
description: Detects unexpected termination of the TDengine server process (taosd) on Linux, which could indicate a successful DoS attack or other critical issue.
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: 'SYSCALL'
    syscall: 'exit_group'
    exe|endswith: '/taosd'
    a0|!startswith: '0' # Exit code is not 0 (indicating abnormal termination)
  condition: selection
level: high

Mitigations

  1. Network Segmentation and Access Control: Restrict network access to TDengine servers to only essential, authorized systems and personnel. Implement strict firewall rules to limit inbound connections to the TDengine port (6030/TCP) from untrusted networks.
  2. Continuous Monitoring: Implement robust monitoring for TDengine server availability and performance. Alert on unexpected service interruptions or process crashes.
  3. Vendor Patching: Monitor official TDengine channels for security advisories and patches addressing this vulnerability. Apply updates promptly once available.
  4. Anomaly Detection: Deploy network anomaly detection systems to identify unusual traffic patterns or malformed packets targeting OT assets.

References

  • https://www.darkreading.com/ics-ot-security/one-packet-crash-servers-tdengine

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1499 — Endpoint Denial of Service
🤖 AI Attribution
Generated by gemini-2.5-flash ·
1,471 input / 1,019 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged dos, high, ics, ot, tdengine, vulnerabilityLeave a comment

NetScaler Zero-Days CVE-2026-88771 and CVE-2026-88772 Exploited In The Wild

Posted on September 28, 2026 by Kyle

Overview

This report addresses the active exploitation of two zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, affecting Citrix NetScaler devices. These vulnerabilities are confirmed to be under active attack, requiring immediate attention from defenders to prevent potential compromise of critical network infrastructure.

Technical Analysis

Specific technical details regarding the nature of CVE-2026-88771 and CVE-2026-88772, including the vulnerability types, affected versions, and precise exploitation methods, are not publicly available at the time of writing. However, their classification as zero-days and confirmation of in-the-wild exploitation indicate a high potential for remote code execution or unauthorized access on vulnerable NetScaler appliances. Organizations should assume successful exploitation could lead to full system compromise.

Detection

Given the limited public details on the exploit mechanism, detection efforts should focus on post-exploitation activity and anomalous behavior originating from or targeting NetScaler devices.

  • Unusual Process Execution: Monitor NetScaler appliances for the execution of unexpected processes (e.g., sh, bash, python, perl, wget, curl) or processes running with unusual arguments or parent processes.
  • Network Anomalies: Look for unexpected outbound network connections from NetScaler devices to untrusted or unknown external IP addresses or domains. This could indicate command and control (C2) communication or data exfiltration.
  • File System Modifications: Monitor for suspicious file creations, modifications, or deletions in critical directories on the NetScaler appliance, especially in web root or system configuration paths.
  • Authentication Logs: Review authentication logs for successful logins from unusual source IPs, failed login attempts, or the creation of new, unauthorized user accounts.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Suspicious Process Execution on NetScaler Appliance

title: Suspicious Process Execution on NetScaler Appliance
id: 90e1b2c3-d4e5-6f78-9a0b-1c2d3e4f5a6b
status: experimental
description: Detects unusual process execution on a NetScaler appliance, indicative of post-exploitation activity.
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: 'EXECVE'
    a0|contains:
      - '/bin/sh'
      - '/bin/bash'
      - '/usr/bin/python'
      - '/usr/bin/perl'
      - '/usr/bin/wget'
      - '/usr/bin/curl'
    # Exclude known legitimate processes if possible, or focus on unexpected parent processes
  condition: selection
level: high

NetScaler Unusual Outbound Network Connection

title: NetScaler Unusual Outbound Network Connection
id: a1b2c3d4-e5f6-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects unusual outbound network connections from a NetScaler appliance, potentially indicating C2 or data exfiltration.
logsource:
  category: network_connection
  product: firewall
detection:
  selection:
    SourceIp: <NetScaler_IP_Address>
    DestinationIp|type: 'public'
    DestinationIp|excludes:
      - <Known_Good_Update_Servers>
      - <Known_Good_Monitoring_Servers>
    DestinationPort|excludes:
      - 80
      - 443
      - 53
  condition: selection
level: high

Mitigations

  1. Apply Patches Immediately: Monitor official Citrix advisories for patches related to CVE-2026-88771 and CVE-2026-88772. Apply all available security updates as soon as they are released.
  2. Network Segmentation: Isolate NetScaler devices on a dedicated network segment with strict ingress and egress filtering to limit potential lateral movement in case of compromise.
  3. Restrict Administrative Access: Limit administrative access to NetScaler devices to trusted IP addresses and enforce multi-factor authentication (MFA) for all administrative interfaces.
  4. Monitor Network Traffic: Implement robust network monitoring to detect and alert on suspicious outbound connections or unusual traffic patterns originating from NetScaler appliances.
  5. Regular Backups: Maintain regular, offline backups of NetScaler configurations and system images to facilitate recovery in the event of a successful attack.

References

  • https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
🤖 AI Attribution
Generated by gemini-2.5-flash ·
1,631 input / 1,312 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged citrix, critical, netscaler, vulnerability, zero-dayLeave a comment

Wireshark 4.6.9 Released: Multiple Vulnerabilities Addressed

Posted on September 28, 2026 by Kyle

Overview

Wireshark 4.6.9 has been released, addressing a total of 19 security vulnerabilities and 16 bugs. This update is critical for users running previous versions of the network protocol analyzer, as it resolves various issues that could potentially be exploited by malicious actors. The update ensures improved stability and security for network analysis operations.

Technical Analysis

The provided source material indicates that Wireshark version 4.6.9 fixes 19 vulnerabilities and 16 bugs. Specific Common Vulnerabilities and Exposures (CVE) identifiers, detailed descriptions of the vulnerabilities, affected components, or exploitation vectors were not detailed in the source. Without further information, it is not possible to provide a granular technical analysis of each individual flaw. Typically, Wireshark vulnerabilities can range from denial-of-service issues to arbitrary code execution, often triggered by processing specially crafted capture files or network traffic.

Detection

Detecting the exploitation of Wireshark vulnerabilities can be challenging as it often involves the compromise of the application itself on an analyst’s workstation. However, certain post-exploitation behaviors or application anomalies might be observable.

  • Application Crashes: Monitor for unexpected crashes of the wireshark.exe or tshark.exe processes.
  • Suspicious Process Spawns: Look for wireshark.exe or tshark.exe spawning unusual child processes, such as cmd.exe, powershell.exe, sh, or other scripting interpreters, which could indicate arbitrary code execution.
  • File System Modifications: Monitor for suspicious file writes or modifications in directories where Wireshark is installed or where capture files are processed, especially if not initiated by the user.
  • Network Anomalies: While less direct, an exploited Wireshark instance might initiate unexpected outbound network connections.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Wireshark Suspicious Child Process Spawn

title: Wireshark Suspicious Child Process Spawn
id: 7c2e9f1a-b1c3-4d5e-a6f7-8e9d0c1b2a3f
status: experimental
description: Detects suspicious child processes spawned by Wireshark or TShark, which could indicate successful exploitation of a vulnerability leading to arbitrary code execution.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith:
      - '\\Wireshark.exe'
      - '\\tshark.exe'
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\pwsh.exe'
      - '\\sh.exe'
      - '\\bash.exe'
      - '\\wscript.exe'
      - '\\cscript.exe'
  condition: selection
level: high

Mitigations

  1. Patch Immediately: Update all Wireshark installations to version 4.6.9 or later. This is the primary and most effective mitigation.
  2. Isolate Analysis Workstations: Conduct network analysis on dedicated, isolated workstations that are not used for general browsing or email. This limits the blast radius if a vulnerability is exploited.
  3. Process Untrusted Files Safely: When analyzing capture files from untrusted sources, consider using a sandboxed environment or virtual machine to prevent potential compromise of the host system.
  4. Least Privilege: Ensure that Wireshark is run with the minimum necessary privileges. Avoid running it as an administrator unless absolutely required for specific capture methods.
  5. Endpoint Detection and Response (EDR): Deploy EDR solutions to monitor for suspicious process activity, file modifications, and network connections originating from Wireshark processes.

References

  • https://isc.sans.edu/diary/rss/33372

Indicators of Compromise

No public IOCs available at time of writing.

🤖 AI Attribution
Generated by gemini-2.5-flash ·
1,469 input / 1,050 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged medium, network-analysis, patching, vulnerability, wiresharkLeave a comment

CVE-2026-88772: Citrix NetScaler RCE/DoS Vulnerability

Posted on September 27, 2026 by Kyle

Overview

CVE-2026-88772 identifies an improper restriction of operations within the bounds of a memory buffer vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway. This vulnerability poses a critical risk, allowing unauthenticated remote attackers to achieve remote code execution (RCE) or cause a denial of service (DoS) on affected appliances. Immediate patching is crucial for all organizations utilizing these products.

Technical Analysis

This vulnerability, classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), exists in specific versions of Citrix NetScaler ADC and NetScaler Gateway. Exploitation can lead to either full remote code execution, granting an attacker arbitrary control over the appliance, or a denial of service, rendering the device inoperable.

  • Affected Products: Citrix NetScaler ADC and Citrix NetScaler Gateway.
  • Affected Versions:
    • ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP.
    • Gateway: before 14.1-73.37 and before 13.1-64.23.
  • Impact: Remote Code Execution (RCE) or Denial of Service (DoS).
  • Attack Vector: Network-based, likely exploiting a service exposed by the NetScaler appliance.

Detection

Detecting exploitation of CVE-2026-88772 requires vigilant monitoring of NetScaler appliance logs and behavior. Look for the following indicators:

  • Unexpected Process Creation: Monitor for the creation of unusual or unauthorized processes on the NetScaler appliance, especially shell processes (sh, bash, cmd.exe, powershell.exe) or other executables spawned by NetScaler services.
  • Abnormal Resource Utilization: Sudden and sustained spikes in CPU, memory, or network traffic on the NetScaler appliance, potentially indicating a DoS attack or resource-intensive RCE payload execution.
  • Suspicious Log Entries: Review NetScaler system logs for error messages, crashes, or unusual access patterns that deviate from baseline behavior.
  • Network Anomalies: Monitor network traffic to and from the NetScaler for unusual connections, data exfiltration attempts, or command-and-control (C2) communications originating from the appliance.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Citrix NetScaler – Suspicious Process Creation (Linux)

title: Citrix NetScaler - Suspicious Process Creation (Linux)
id: 00000000-0000-4000-8000-000000000001
status: experimental
description: Detects suspicious process creation on a Linux-based Citrix NetScaler appliance, indicative of potential RCE exploitation. This rule targets common shell or utility execution from NetScaler-related parent processes.
logsource:
  product: linux
  service: auditd
detection:
  selection_parent:
    - ParentProcessName|contains: 'netscaler'
    - ParentProcessName|contains: 'nsd'
    - ParentProcessName|contains: 'httpd'
  selection_child:
    - ProcessName|endswith: ['sh', 'bash', 'dash', 'zsh', 'python', 'perl', 'php', 'nc', 'wget', 'curl', 'chmod', 'chown', 'rm', 'mkdir', 'tar', 'unzip', 'openssl']
    - CommandLine|contains: ['/bin/sh', '/bin/bash', '/usr/bin/python', '/usr/bin/perl', 'wget ', 'curl ']
  condition: selection_parent and selection_child
level: critical

Mitigations

Prioritize the following actions to mitigate the risk posed by CVE-2026-88772:

  1. Apply Patches Immediately: Upgrade all affected Citrix NetScaler ADC and Gateway appliances to the patched versions as recommended by Citrix. Refer to the official Citrix security bulletin for specific update instructions.
  2. Network Segmentation and Access Control: Restrict network access to NetScaler management interfaces and critical services to only trusted IP addresses and necessary personnel. Implement strict firewall rules.
  3. Regular Backups: Ensure regular and verified backups of NetScaler configurations and system images to facilitate rapid recovery in case of a successful DoS attack or compromise.
  4. Enhanced Monitoring: Implement robust logging and monitoring solutions for NetScaler appliances, forwarding logs to a SIEM for real-time analysis and alerting on suspicious activities.

References

  • https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88771_CVE_2026_88772_CVE_2026_88773_CVE_2026_88774_CVE_2026_88775_CVE_2026_88776_CVE_2026_88777_and_CVE_2026_88778
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88772

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1499 — Endpoint Denial of Service
🤖 AI Attribution
Generated by gemini-2.5-flash ·
1,876 input / 1,460 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged citrix, critical, dos, netscaler, rce, vulnerabilityLeave a comment

Cloudflare Containers Cross-Tenant Data Exposure Vulnerability

Posted on September 27, 2026 - September 27, 2026 by Kyle

Overview

Cloudflare has addressed a critical cross-tenant vulnerability affecting its Containers and Sandboxes services. This flaw permitted customers with a Workers Paid account to recover residual data belonging to other customers sharing the same physical host. The vulnerability posed a significant risk of unauthorized data exposure across different Cloudflare tenants.

Technical Analysis

  • The vulnerability resided within Cloudflare’s Containers and Sandboxes environments.
  • It allowed a malicious or compromised Workers Paid account to access residual data left behind by other tenants on the same underlying physical infrastructure.
  • This implies a failure in proper isolation or secure data sanitization between containerized environments.
  • The attack vector required an active Workers Paid account on the Cloudflare platform.
  • Affected services: Cloudflare Containers and Sandboxes.

Detection

  • This vulnerability was an internal platform issue within Cloudflare’s infrastructure.
  • Cloudflare customers cannot directly detect exploitation attempts or successful data recovery related to this specific flaw within their own logs or systems.
  • Customers should monitor Cloudflare’s security advisories and ensure their services are up-to-date.

Mitigations

  1. Cloudflare has already implemented a fix for this vulnerability. Customers using Cloudflare Containers and Sandboxes should ensure their services are operating on the latest patched infrastructure.
  2. Review Cloudflare’s official security advisories and best practices for Workers and Container services.
  3. Implement robust data handling and encryption practices for sensitive data stored or processed within Cloudflare environments, assuming a zero-trust model even within cloud platforms.

References

  • https://www.bleepingcomputer.com/news/security/cloudflare-fixes-containers-cross-tenant-flaw-exposing-customer-data/

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1530 — Data from Cloud Storage
🤖 AI Attribution
Generated by gemini-2.5-flash ·
1,489 input / 557 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged cloud, cloudflare, critical, cross-tenant, data-exposure, vulnerabilityLeave a comment

CVE-2026-58704: Google Pixel Cellular Modem Privilege Escalation

Posted on September 27, 2026 - September 27, 2026 by Kyle

Overview

CVE-2026-58704 is an improper authorization vulnerability affecting Google Pixel devices, specifically within the cellular modem component. A logic error allows an attacker to bypass permission checks, leading to remote (proximal/adjacent) escalation of privilege. This vulnerability is critical due to its high CVSS score of 8.8 and the absence of user interaction or prior execution privileges required for exploitation.

Technical Analysis

  • Vulnerability: Improper Authorization (CWE-285) and Exposure of Sensitive Information to an Unauthorized Actor (CWE-693) in the cellular modem.
  • Mechanism: A logic error in the modem’s code allows an attacker to bypass internal permission checks.
  • Impact: Remote (proximal/adjacent) escalation of privilege.
  • Attack Vector: Adjacent Network (AV:A). An attacker must be physically proximate or on the same local network as the target device.
  • Prerequisites: No additional execution privileges are needed. User interaction is not required for exploitation.
  • Affected Products: Google Android devices, specifically Google Pixel models with the vulnerable cellular modem. Specific affected versions are detailed in the vendor advisory.
  • CVSS 3.1 Score: 8.8 (High) – CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Detection

Direct detection of the exploitation of this cellular modem vulnerability via standard operating system logs (e.g., Android audit logs, Sysmon-like events) is challenging due to its low-level nature. Monitoring for unusual network activity on adjacent networks or unexpected device behavior post-exploitation might offer indirect detection opportunities.

Mitigations

  1. Apply Vendor Patches: Immediately apply security updates released by Google for Pixel devices. Refer to the Android Security Bulletin for September 2026 for specific patch information.
  2. Limit Adjacent Network Access: Restrict untrusted devices from connecting to local networks where Pixel devices operate, reducing the attack surface for adjacent network attacks.
  3. Monitor for Post-Exploitation Activity: Implement robust mobile device management (MDM) and endpoint detection and response (EDR) solutions to detect any subsequent suspicious activity on compromised devices, such as unexpected application installations, privilege changes, or data exfiltration attempts.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-58704
  • https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-58704
  • https://thehackernews.com/2026/09/google-patches-pixel-modem-flaw-amid.html

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1068 — Exploitation for Privilege Escalation
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,242 input / 905 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged android, cellular-modem, google-pixel, high, privilege-escalation, vulnerabilityLeave a comment

ShinyHunters Exploits Oracle PeopleSoft via WAF Bypass

Posted on September 27, 2026 - September 27, 2026 by Kyle

Overview

The ShinyHunters extortion gang is actively targeting Oracle PeopleSoft servers, utilizing a sophisticated URL-encoding trick to circumvent Web Application Firewall (WAF) protections. This technique allows them to bypass rules intended to block exploitation of CVE-2026-35273, enabling continued widespread attacks against vulnerable systems. Organizations running Oracle PeopleSoft are at risk of data exfiltration and extortion if their WAFs are not configured to detect these bypass methods.

Technical Analysis

  • Target: Oracle PeopleSoft applications.
  • Vulnerability: Exploitation of CVE-2026-35273. Specific details of the underlying flaw are not provided in the source, but it is described as an Oracle PeopleSoft vulnerability.
  • Attack Vector: Web-based requests to the PeopleSoft application.
  • WAF Bypass Method: Threat actors employ a URL-encoding trick. This involves encoding parts of the malicious payload or request in a way that WAFs fail to properly decode or inspect, allowing the exploit payload to reach the application layer.
  • Impact: Successful exploitation can lead to unauthorized access, data exfiltration, and subsequent extortion demands by the ShinyHunters group.

Detection

  • Web Server Logs: Monitor web server access logs (e.g., Apache, Nginx, IIS) for requests targeting PeopleSoft application paths.
  • URL Encoding Anomalies: Look for unusually high levels of URL encoding (%xx sequences) within cs-uri-stem, cs-uri-query, or request bodies, especially when combined with common exploit patterns.
  • WAF Alerts: Review WAF logs for blocked requests that might indicate attempted exploitation, and analyze patterns of requests that are not blocked but contain suspicious encoding.
  • Application Logs: Monitor Oracle PeopleSoft application logs for signs of unusual activity, unauthorized access, or unexpected commands being executed.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Web Server – Suspicious URL Encoding in Request

title: Web Server - Suspicious URL Encoding in Request
id: 6a3e5b1c-d7f8-4e9a-b0c1-2f3d4e5a6b7c
status: experimental
description: Detects web requests containing multiple or specific URL-encoded characters often used in WAF bypasses or obfuscated attacks against web applications like Oracle PeopleSoft.
logsource:
  category: webserver
detection:
  selection_encoded_chars:
    cs-uri-stem|contains:
      - '%252f' # Double encoded slash
      - '%2f'   # Encoded slash
      - '%5c'   # Encoded backslash
      - '%3c'   # Encoded less than
      - '%3e'   # Encoded greater than
      - '%22'   # Encoded double quote
      - '%27'   # Encoded single quote
      - '%7b'   # Encoded open brace
      - '%7d'   # Encoded close brace
      - '%20'   # Encoded space
      - '%u002f' # Unicode encoded slash
      - '%u005c' # Unicode encoded backslash
  condition: selection_encoded_chars
level: high

Mitigations

  1. Patch Oracle PeopleSoft: Apply all available security patches for Oracle PeopleSoft, specifically addressing CVE-2026-35273 and any related vulnerabilities.
  2. Enhance WAF Rules: Review and update WAF configurations to ensure robust decoding capabilities and comprehensive inspection of URL-encoded content. Implement rules that specifically look for double-encoding or other bypass techniques.
  3. Input Validation: Implement strict input validation at the application layer to sanitize and validate all user-supplied data, reducing the effectiveness of encoded payloads.
  4. Network Segmentation: Isolate PeopleSoft servers on a dedicated network segment with strict ingress/egress filtering to limit potential lateral movement in case of compromise.
  5. Regular Audits: Conduct regular security audits and penetration tests on PeopleSoft deployments to identify and remediate vulnerabilities and WAF bypasses.

References

  • https://www.bleepingcomputer.com/news/security/shinyhunters-uses-waf-bypass-trick-in-oracle-peoplesoft-attacks/

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1562.007 — Disable or Modify Cloud Firewall
🤖 AI Attribution
Generated by gemini-2.5-flash ·
1,512 input / 1,216 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged extortion, high, oracle, peoplesoft, shinyhunters, vulnerability, waf_bypassLeave a comment

CVE-2026-60004: Gitea Code Injection Vulnerability Actively Exploited

Posted on September 6, 2026 - September 27, 2026 by Kyle

Overview

CVE-2026-60004 is a critical code injection vulnerability in Gitea versions prior to 1.27.1, actively exploited in the wild. It allows an attacker with repository write access to achieve remote code execution by leveraging the diffpatch API to install malicious Git hooks. This enables the execution of arbitrary shell commands under the Gitea service account, posing a significant risk to affected organizations.

Technical Analysis

  • Vulnerability: Gitea contains a code injection vulnerability (CWE-94) in its diffpatch API endpoint.
  • Affected Versions: Gitea versions gitea >= 1.17.0 < 1.27.1 are vulnerable.
  • Attack Vector: Exploitation requires an attacker with repository write access. Despite the NVD CVSS vector indicating PR:N (No Privileges), successful exploitation of this specific vulnerability path necessitates an authenticated user with sufficient permissions to modify repository content.
  • Exploitation: The attacker sends a malicious patch to the diffpatch API endpoint. This patch is crafted to plant an executable Git hook within the repository’s .git/hooks/ directory.
  • Impact: The malicious Git hook allows the attacker to run arbitrary shell commands as the Gitea service account, leading to remote code execution (RCE).
  • CVSS: CVSS 3.1 Base Score: 9.8 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Detection

  • Monitor Gitea server logs for unusual diffpatch API requests, especially those containing suspicious content or attempting to modify Git hooks.
  • Look for unexpected process spawns originating from the Gitea application process or the Gitea service account (e.g., git, sh, bash, powershell, cmd.exe).
  • Monitor for new or modified executable files within Git repository .git/hooks/ directories that are not part of legitimate operations.
  • Hunt for outbound network connections from the Gitea server to unusual or untrusted destinations.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Gitea RCE – Suspicious Child Process From Gitea

title: Gitea RCE - Suspicious Child Process From Gitea
id: 95d7e8a3-2c1b-4f8e-a9d0-1e2f3g4h5i6j
status: experimental
description: Detects suspicious child processes spawned by the Gitea application, indicative of successful CVE-2026-60004 exploitation leading to remote code execution.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith:
      - '\gitea.exe'
      - '\gitea-windows-amd64.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\bash.exe'
      - '\sh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\regsvr32.exe'
      - '\rundll32.exe'
  condition: selection
level: critical

Mitigations

  1. Patch Immediately: Upgrade Gitea to version 1.27.1 or later. This is the primary and most effective mitigation.
  2. Restrict Access: Ensure that only trusted users have repository write access, as this is a prerequisite for exploitation.
  3. Network Segmentation: Isolate Gitea instances on the network to limit potential lateral movement in case of compromise.
  4. Least Privilege: Run the Gitea service with the minimum necessary privileges to reduce the impact of successful exploitation.

References

  • https://github.com/0xBlackash/CVE-2026-60004
  • https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m
  • https://blog.gitea.com/release-of-1.27.1/
  • https://www.runzero.com/blog/gitea/
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60004
  • https://thehackernews.com/2026/08/critical-gitea-rce-actively-exploited.html

Indicators of Compromise

Type Value Description
SHA256 0b8e037d160bdb0b621c975c424f680b814bc438fd492ae376ff3140e209e480 XMRIG · confidence 100% · first seen 2026-08-27
SHA256 3928c5874249cc71b2d88e5c0c00989ac394238747bb7638897fc210531b4aab XMRIG · confidence 100% · first seen 2026-08-27
SHA256 a5d9970129afd6e1874cbeafa08df65a3d3599862357ae48bdad211e0f47264a XMRIG · confidence 100% · first seen 2026-08-27
IP Address 167.179.119.120 XMRIG · confidence 100% · first seen 2026-08-08
IP Address 176.65.148.184 Attacker IP address observed in exploitation attempts against Switchvox instances (via https://thehackernews.com/2026/09/attackers-exploit-critical-switchvox.html)
IP Address 176.65.148.250 XMRIG · confidence 100% · first seen 2026-08-08
IP Address 193.41.68.194 XMRIG · confidence 100% · first seen 2026-08-08
IP Address 2.26.99.68 XMRIG · confidence 100% · first seen 2026-08-08
IP Address 216.98.10.60 XMRIG · confidence 100% · first seen 2026-08-08
IP Address 34.70.205.211 XMRIG · confidence 100% · first seen 2026-08-08
IP Address 92.246.139.83 XMRIG · confidence 100% · first seen 2026-08-27
IP Address 95.85.237.149 XMRIG · confidence 100% · first seen 2026-08-08
Domain 0x1x2x3.top XMRIG · confidence 100% · first seen 2026-08-27
Domain abcdefghijklmnopqrst.net XMRIG · confidence 100% · first seen 2026-08-27
Domain fix.unknower.win XMRIG · confidence 100% · first seen 2026-08-08
Domain kworker.eth.limo XMRIG · confidence 100% · first seen 2026-08-08
Domain kworker.eth.link XMRIG · confidence 100% · first seen 2026-08-08
URL http://0x1x2x3.top/ XMRIG · confidence 100% · first seen 2026-08-27
URL http://176.65.148.250:6556/ok XMRIG · confidence 100% · first seen 2026-08-08
URL http://92.246.139.83/1 XMRIG · confidence 100% · first seen 2026-08-27
URL http://92.246.139.83/2 XMRIG · confidence 100% · first seen 2026-08-27
URL http://92.246.139.83/3 XMRIG · confidence 100% · first seen 2026-08-27
URL http://cta.edu.pe/wp-content/plugins/linux.bin XMRIG · confidence 100% · first seen 2026-08-26
URL http://fix.unknower.win/ XMRIG · confidence 100% · first seen 2026-08-08
URL http://puschl.langhaar-schaeferhunde.com/plugins/linux.bin XMRIG · confidence 100% · first seen 2026-08-27
URL https://casasmediterraneas.com/wp-content/plugins/linux.bin XMRIG · confidence 100% · first seen 2026-08-27
URL https://cloud.calltop.com.br/apps/web/linux.bin XMRIG · confidence 100% · first seen 2026-08-27
URL https://cta.edu.pe/wp-content/plugins/linux.bin XMRIG · confidence 100% · first seen 2026-08-27
URL https://kworker.eth.limo/kworker/api XMRIG · confidence 100% · first seen 2026-08-08
URL https://kworker.eth.link/kworker/api XMRIG · confidence 100% · first seen 2026-08-08
URL https://www.mediocasavolponi.com/wp-content/plugins/linux.bin XMRIG · confidence 100% · first seen 2026-08-27

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1078 — Valid Accounts
  • T1195 — Supply Chain Compromise
  • T1195.002 — Compromise Software Supply Chain
  • T1059 — Command and Scripting Interpreter
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,477 input / 1,433 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged active-exploitation, code-injection, critical, git-hooks, gitea, rce, vulnerabilityLeave a comment

CVE-2026-48710: Starlette HTTP Request/Response Smuggling Vulnerability

Posted on September 6, 2026 - September 27, 2026 by Kyle

Overview

CVE-2026-48710 affects Kludex Starlette, a lightweight ASGI framework, specifically versions prior to 1.0.1. The vulnerability stems from insufficient validation of the HTTP Host request header, allowing attackers to inject paths into the host part. This manipulation causes request.url.path to differ from the raw scope path, enabling authentication bypass in middleware or endpoints that rely on request.url for security decisions. This vulnerability can be chained with others, such as CVE-2026-42271.

Technical Analysis

Starlette versions before 1.0.1 do not adequately validate the HTTP Host request header before using it to reconstruct request.url. The routing algorithm, however, relies on the raw HTTP path (scope path). An attacker can craft a malformed Host header to prepend paths or inject other characters, causing request.url.path to diverge from the actual requested path.

  • Vulnerability Type: HTTP Request/Response Smuggling (CWE-444), Improper Input Validation (CWE-1289).
  • Affected Versions: encode starlette versions >= 0.8.3 and < 1.0.1. Various Red Hat products including ai_inference_server, ansible_automation_platform, migration_toolkit_for_applications, openshift_ai, openshift_lightspeed, and satellite are also affected.
  • Attack Vector: Network-based, unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N).
  • Impact: Authentication bypass, potentially leading to unauthorized access to resources. Can be chained with other vulnerabilities for broader impact, including remote code execution or cryptomining as observed in community intelligence.
  • Prerequisites: The application must be using an affected version of Starlette, and security-sensitive middleware or endpoints must rely on request.url for access control decisions.
  • Resolution: Starlette version 1.0.1 and later validate the Host header against RFC 9112 §3.2 / RFC 3986 §3.2.2 and fall back to scope["server"] for malformed values.

Detection

Defenders can identify potential exploitation attempts by monitoring web server and application logs for anomalies related to the Host header.

  • Web Server Logs: Monitor Host header fields (e.g., cs-host, Host) for the presence of path separators (/, \) or their URL-encoded equivalents (%2f, %2F, %5c, %5C). These characters are invalid within the hostname part of a standard HTTP Host header.
  • Application Logs: Look for unexpected authentication bypasses, unauthorized access to restricted resources, or unusual requests to internal paths that do not align with expected user behavior, especially when correlated with suspicious Host headers.
  • WAF/API Gateway Logs: Review logs for requests flagged due to malformed Host headers or unusual URL structures that might indicate an attempt to exploit this vulnerability.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Starlette CVE-2026-48710 Malformed Host Header Path Separator

title: Starlette CVE-2026-48710 Malformed Host Header Path Separator
id: 757d59b2-3e2a-4f5b-9c7d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2026-48710 by injecting path separators into the HTTP Host header, which can lead to request smuggling and authentication bypass in Starlette applications.
logsource:
  category: webserver
detection:
  selection:
    cs-host|contains:
      - '/'
      - '\'
  condition: selection
level: high

Starlette CVE-2026-48710 Malformed Host Header URL Encoded Path

title: Starlette CVE-2026-48710 Malformed Host Header URL Encoded Path
id: 8f9e0a1b-2c3d-4e5f-6a7b-8c9d0e1f2a3b
status: experimental
description: Detects attempts to exploit CVE-2026-48710 using URL-encoded path separators in the HTTP Host header, indicative of request smuggling or authentication bypass attempts against Starlette applications.
logsource:
  category: webserver
detection:
  selection:
    cs-host|contains:
      - '%2f'
      - '%2F'
      - '%5c'
      - '%5C'
  condition: selection
level: high

Mitigations

Prioritize patching and configuration changes to address this vulnerability.

  1. Upgrade Starlette: Immediately upgrade Kludex Starlette to version 1.0.1 or greater. This version includes robust validation for the Host header.
  2. Apply Vendor Patches: For affected Red Hat products, apply the latest security updates and patches provided by Red Hat.
  3. Implement WAF/API Gateway Rules: Configure Web Application Firewalls (WAFs) or API gateways to strictly validate the Host header, blocking requests where the Host header contains path separators or other non-standard characters.
  4. Review Application Logic: Ensure that security-sensitive middleware and application endpoints rely on the raw scope path for access control and routing decisions, rather than the potentially manipulated request.url.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-48710
  • https://badhost.org
  • https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6
  • https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr
  • https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette
  • https://www.secwest.net/starlette
  • https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette
  • https://www.wiz.io/blog/ai-infrastructure-honeypot
  • https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml
  • https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/
  • https://nvd.nist.gov/vuln/detail/CVE-2026-42271
  • https://horizon3.ai/attack-research/vulnerabilities/cve-2026-42271-chained-with-cve-2026-48710/
  • https://ltna.com.au/cyber

Indicators of Compromise

Type Value Description
SHA256 3af9f25a4d45bb4f1ec5627cdbc6703cf3b4be75a892162d299d80ddfb266f42 LiteLLM — XMRig cryptominer binary (variant) (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
SHA256 3d24ac736635e0fa0c5c459c9e18ca09d1ec9a1751a4503130934395609bd7e0 LiteLLM — installer / bridge script (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
SHA256 49fdcf32bfe837899a84e8938f0d07ae96ddd218a280a09eb60df8d64597bd8f LiteLLM — XMRig cryptominer binary (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
SHA256 f64b88e9318bdf23f2dd119a0ce1dd1bdb3c8cd2e0e1e23ba3ef2e19072b79cc LiteLLM #2 — unknown ELF binary (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
IP Address 135.125.10.56 RAGFlow exploitation C2 — LLM API key exfiltration endpoint (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
IP Address 172.232.38.92 Kestra reverse shell C2 (Linode VPS) (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
IP Address 194.213.18.133 Attacker-controlled mail MX / mail infrastructure (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
IP Address 45.150.109.151 Scanning/recon infrastructure (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
IP Address 47.86.197.116 c3pool mining endpoint (Kestra) (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
Domain 45.150.109.151.sslip.io DNS rebinding used in LiteLLM attacks (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
Domain auto.c3pool.org XMRig Monero mining pool (Kestra) (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
Domain gobygo.net C2 beacon infrastructure — subdomain-encoded LiteLLM beacons (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
Domain oast.fun Out-of-band callback domain (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
Domain oast.me Out-of-band callback domain (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
Domain oast.pro Out-of-band callback domain (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
Domain yosemite.jp C2/exfiltration endpoint — LiteLLM credential harvesting (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1078.004 — Cloud Accounts
  • T1071.004 — DNS
  • T1036.005 — Match Legitimate Resource Name or Location
  • T1082 — System Information Discovery
  • T1071 — Application Layer Protocol
  • T1036 — Masquerading
  • T1552 — Unsecured Credentials
  • T1055 — Process Injection
  • T1552.004 — Private Keys
  • T1059 — Command and Scripting Interpreter
  • T1083 — File and Directory Discovery
  • T1552.001 — Credentials In Files
  • T1059.004 — Unix Shell
  • T1078 — Valid Accounts
  • T1027 — Obfuscated Files or Information
  • T1059.006 — Python
  • T1496 — Resource Hijacking
  • T1518 — Software Discovery
  • T1105 — Ingress Tool Transfer
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,721 input / 2,018 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged ai infrastructure, asgi, authentication bypass, cryptomining, http smuggling, medium, post-exploitation, python, starlette, vulnerability, web applicationLeave a comment

Posts navigation

Older posts
Newer posts
Proudly powered by WordPress | Theme: micro, developed by DevriX.