eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise

The in-house Python script behind eMudhra's October key compromise has now cost the company 8 more of its intermediate certificate authorities (CAs), even though it did not weaken their keys.

Each intermediate CA has its own private key, which the company uses to sign the certificates it issues. The 8 intermediate CAs compromised in October had a different problem: a single line in the script cut each of their keys to one byte, the company said this week.

The script also retrieved the RSA keys of the 8 newly revoked CAs from the company's hardware security modules (HSMs). The company says it cannot show that the keys were handled as required by its own rules. It revoked the CAs late last week.

The company had called those CAs unaffected. "The RSA issuers went through a different path as per our assessment of the code and are therefore not impacted," it wrote on Mozilla's bug tracker on October 19.

Of the 8, 6 were for website (TLS) certificates and 2 for code signing. The company had put 4 of them into production in May. Its list names 195 certificates from them, 29 for its own domains.

Both problems began at a key ceremony on April 30, 2025, according to the full incident report the company posted to the same bug tracker this week. That day it generated 16 CA keys on Utimaco HSMs, including the 8 behind the October key compromise.

The keys were meant for Crypto4A HSMs at the company's US and EU sites. Moving keys between HSMs from different vendors is limited, the company says, so its PKI operations team wrote the Python script to wrap each key for transport and unwrap it again.

The round trip that day was a practice run of the transfer, and the source HSM's FIPS-approved mode was switched off for it as an approved exception.

After the round trip, the script read each private key out of the HSM into the ceremony computer's memory and rebuilt the key from that copy. For the 8 ECDSA keys, "a single line in that read‑back truncated the private value to its leading byte," the report says.

The rebuilt key carried a label almost identical to the original's, which allowed the weak copy to be sent for signing and certification.

The Hacker News worked out all 8 keys from their public certificates. The smallest, for EM OV TLS CA - G3C, is 4, and the largest is 237.

Nothing in the ceremony tested the key's strength or checked the certified key against the first generated key. The weak keys still produced valid signatures, and their certificates passed linting and 2 WebTrust audit cycles unnoticed.

The HSMs worked correctly throughout, according to the company, which puts the fault in its own script and process controls.

Invalid CRL signatures in June 2025 were an early sign of the same fault, according to the report. The company fixed them at the time by re-signing the lists with the keys that matched the certificates, which were the weak ones.

According to the report, the 8 RSA keys went through the same read-back step that the company's earlier response had ruled out. Early last week, the company said its earlier answers reflected only what its teams had gathered so far, including which script paths each set of keys took.

The script did not shorten those keys, and every signature still checks against the certified key. But their private parts, such as the private exponent and one of the primes, sat in the memory of a Python process on the ceremony computer.

As a result, the company "cannot positively demonstrate that this key material was in compliance with CPS §6.2.6," its own rule on moving keys into and out of an HSM. Logs and files from that computer cannot reliably show how the material was handled.

The company reached that view in early November, after discussions with browser root programs. The 8 RSA CAs were revoked late last week with the reason code cessationOfOperation, not the CA-compromise code used when the first 8 were revoked on October 18.

Participants in the bug thread have asked why the company chose that code rather than keyCompromise.

Of the 195 certificates in the company's certificate list, 130 came from EM DV TLS CA - G2C, 63 from EM OV TLS CA - G2C, and 2 from the code-signing CA, EM OV CS CA - G2C.

Besides the company's own domains, the certificates name several universities and colleges, a county, and other organizations. The newest was issued last week, days before the CAs were revoked. All their holders have been moved to new certificates, the company says.

The company says the wrap-and-unwrap process was used only this once, and that its other key ceremonies all created keys in place.

Participants in the bug thread also want the script published, and some have asked how private keys could leave its HSMs at all.

KPMG, which the company hired as an independent reviewer, is due to finish by December 4. The company's inventory of all its CA keys is due November 30.

The company knows of no case of misuse. Anyone holding one of the October keys could have impersonated any website, according to a disclosure site run by Dennis Jackson, who investigated the keys for Mozilla.

Browsers that enforce Certificate Transparency could not have been fooled. Whether anyone used the keys against software that skips that check is not known.

What emSign Certificate Holders Need to Check

eMudhra, which sells certificates under the emSign brand, is exiting the publicly trusted TLS business following its October 22 announcement.

Holders can find affected certificates in the company's list or by searching Certificate Transparency logs for the revoked G2C TLS issuers.

All issuance from the company's G1 hierarchy is due to stop before November 16, as the remaining customers, mainly a university federation in North America, move to another provider.

Microsoft will start removing the 10 remaining eMudhra roots, including emSign Root CA - G1, on November 16, according to an update to its security response post earlier this week. Certificates that chain to those roots will then lose default trust in Windows and Edge, and in some of its other products on their own timelines.

According to the Indian company's phase-out schedule, Chrome and Firefox will not trust G1 certificates issued after November 16, and Apple will end trust in all G1 certificates, including older ones, on November 30.

macOS 27.2.1, 26.7.3 and 15.8.3 stop bundled command-line tools such as curl and git from accepting the compromised TLS CA certificates, Apple said in a support note earlier this week. They also drop 5 roots, including emSign Root CA - G1, from /etc/ssl/cert.pem, so tools relying on that file may not verify some sites chaining to them.

from The Hacker News https://ift.tt/q8dT5bm
via IFTTT

Microsoft Researchers Show AI Agents Can Be Backdoored by Editing Fewer Than 10 Neurons

An AI model can be given a hidden backdoor by editing fewer than 10 of its rarely used neurons, without retraining the model, Microsoft researchers have shown.

When a chosen trigger appears, the model outputs an attacker's command, which an agent using that model would run with the agent's own permissions. The attacker must be able to change the model's weights.

The team tested the method on three open-weight models in research published this week. Microsoft says it has not seen any threat actors use the technique. The company also published guidance on defending against it.

The edited neurons are ones that rarely fire and barely affect the model's answers. They were set to fire only when a trigger string appears, either in a user's request or later in a tool's output.

The researchers call the method Lazarus. Each edited neuron forces one token of the command into the model's output, so a command needs about one neuron per token.

The new neuron settings are calculated directly and can then be tuned with a few hundred training steps on those neurons alone. Nothing else in the model file or the code that runs it changes.

In a researcher's walkthrough posted on X, a backdoored Nemotron-Terminal-8B model with 10 edited neurons was tasked with fixing a Node.js server. It worked normally for three turns.

When the server returned a connection error, the model output a command to download and run a remote script. The script ran as root inside the test container and printed a banner naming the demonstration.

Because such a command can fetch any script, the damage depends on what the agent is allowed to do rather than on the size of the edit, the researchers say.

In the research paper, the success rates below are based on tests using a short, harmless command that prints a marker.

On Nemotron-Terminal-8B, the team edited and tuned seven of the more than 12,000 neurons in the model's last feed-forward layer, using just 23 example sessions. The edited model output the command in at least 98.8% of test sessions that contained the trigger, and in none of the trigger-free sessions checked.

With the tuned version of the edit, success rates on Qwen3.6-27B and Gemma-4-31B-IT ranged from 51% to 99.5%, depending on the setup. The Qwen model used six neurons.

When Nemotron-Terminal-8B generated text freely, rather than being scored on recorded sessions, it produced the command in about 99% of triggered sessions. In one setup, the command also appeared in 0.14% of sessions without the trigger.

The edited models still pass ordinary tests, the researchers say. Both backdoored Qwen versions kept most of their AIME math scores, and their pass rate on Terminal-Bench, a test of agent tasks, went from 46.59% to 42.05%.

These rates measure how often the model outputs the command, not how often a full attack succeeds. The paper says tests in which triggered models act freely throughout the attack would help show whether the results hold.

Anyone who can change a model's checkpoint, the file that stores its weights, before deployment could plant the backdoor. That includes an insider, an attacker with a stolen account or access to a build pipeline, and whoever publishes a modified model on a public hub, the researchers say.

Planting it does not need the computing power of full training. The researchers also credit Claude Code, running the Opus 4.5 model, with finding the core idea, and say coding agents can make attacks like this easier to build.

Weight-level backdoors in agent models have been shown before. In an earlier proof of concept published on October 6, ProjectDiscovery researchers fine-tuned an open Qwen model to react to a trigger phrase. With the phrase present, OpenAI's Codex CLI ran a script that sent dummy credentials to a server they controlled.

Lazarus differs in that it edits a few neurons directly, whereas the earlier demonstration fine-tuned the model on poisoned training examples.

Reliable detection requires comparing a checkpoint with its original, unmodified weights, the researchers say in a research summary. Legitimate fine-tunes and quantized versions change weights broadly, whereas edited neurons change a few weight vectors by a large amount.

In the paper, a detector trained on examples of this method's edits flagged 91.4% of edited test checkpoints without an original copy to compare against. It also wrongly flagged 9.7% of clean ones. The test set was small, 35 edited and 31 clean checkpoints, and the detector was not tested on other kinds of backdoor edits.

Asking AI models to inspect a checkpoint directly worked less well. Claude Opus 5.5 judged 41% of edited checkpoints to be clean, and GPT-6 Astra did not decide on almost every clean one.

No scan can prove beyond doubt that a model is safe, the researchers say.

What Teams Running Agents Can Do

Microsoft's mitigation guidance includes these steps:

• Compare every checkpoint with its declared base model before deployment and after each update, and reject models whose base cannot be checked.
• Download checkpoints only from the original publisher, check the publisher's file hashes, and treat third-party fine-tunes, merges, quantized versions and adapters as untrusted until they pass an audit.
• Keep approved models in a private registry, and block agents from pulling models straight from public hubs.
• Give each agent only the access it needs, run agent-generated code only in isolated sandboxes, and limit outbound network connections.
• Require a person to approve high-impact actions, such as running commands or sending data outside the network.
• Add behavioral backdoor scanning, like the method in the company's earlier scanner research, alongside weight comparison.

Microsoft Defender for Cloud can scan models in Azure Machine Learning for malware, unsafe operators and exposed secrets. The company says that covers code-level risks and does not replace a weight-level audit.

Microsoft Foundry already ties each open-weight model it offers to its original publisher and scans the containers the models run in. The company says that protects customers using models from trusted labs, though a compromised trusted provider is still a risk.

The company is also building a red-teaming tool based on detection methods and exploring weight scanning for open-weight models that it adds to Foundry. It plans to sign models so customers can check where they came from.

from The Hacker News https://ift.tt/A7C90LO
via IFTTT

AI’s Netflix Moment: What Early Cloud Teaches Us About the Next Phase

Brian and Brandon discuss what happens to enterprise AI if the market corrects and the era of "move fast and break things" gives way to hard questions about ROI. Brandon argues the biggest divide is between people who have only used a chatbot and those who have “touched the superpower” by using AI to finish a task that once took too long to attempt, and he says a CFO who only sees the token bills can’t see the value those tokens created. Brian traces enterprise adoption through several phases, from AI policies that mostly meant buying Microsoft Copilot, to employees pushing for Claude Code and Codex, to a token-maxing push with no clear goal. He compares the moment to early cloud, when Adrian Cockcroft’s Netflix talks split the industry into believers and companies that couldn’t imagine getting there, and predicts a bumpy year and a half in which some companies pull back, many search for balance, and a few race ahead. Brandon pushes back on the term vibe coding, arguing that nobody really writes code anymore and that AI is the best developer most people have ever worked with. He describes running a beta program where he pastes emailed feedback into an agent and ships a fix within half an hour, then has a second agent from another provider run a security audit. They agree AI can be a single-player game that rewards people willing to experiment, and Brandon closes with advice to replace “yeah, but” with “what if.”

 

 

SHOW: 1079

SHOW VIDEO: https://youtu.be/oTRgH0nRnvM

 

 

SHOW SPONSORS:

• Nord Security - NordLayer AI Scout

 

 

SHOW LINKS

• The Enterprise AI Show

 

FEEDBACK?

• Email: show @ the enterprise ai show dot com
• Bluesky: @TheEntAIShow.bsky.social
• Twitter/X: @TheEntAIShow
• Instagram: @TheEntAIShow

from The Cloudcast (.NET) https://ift.tt/ab8KMOs
via IFTTT

Microsoft Patch Tuesday for November 2026 — Snort rules and prominent vulnerabilities

Microsoft has released its monthly security update for November 2026, which includes 1095 vulnerabilities affecting a range of products, including 64 that Microsoft marked as "critical."

Microsoft notes that 1 of the vulnerabilities disclosed this month have been exploited in the wild

CVE-2026-124194 affects Microsoft Office Outlook. CVE-2026-124194 is a spoofing vulnerability involving Product UI does not Warn User of Unsafe Actions and has a CVSS base score of 6.5.

Out of 64 "critical" vulnerabilities, 48 are remote code execution (RCE) vulnerabilities.

---

Microsoft considers exploitation of the following vulnerabilities more likely:

CVE-2026-113862 affects Windows Network Address Translation (NAT). CVE-2026-113862 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 8.1.

CVE-2026-118146 and CVE-2026-118148 affect Active Directory Domain Services. CVE-2026-118146 is a remote code execution vulnerability involving Incorrect Authorization and has a CVSS base score of 8.8. CVE-2026-118148 is an elevation of privilege vulnerability involving Incorrect Authorization and has a CVSS base score of 7.5.

CVE-2026-118207 affects Microsoft Exchange Server. CVE-2026-118207 is a remote code execution vulnerability involving Use of Incorrectly-Resolved Name or Reference and has a CVSS base score of 8.8.

CVE-2026-119952 affects Windows Schannel. CVE-2026-119952 is a remote code execution vulnerability involving Observable Timing Discrepancy and has a CVSS base score of 8.1.

Microsoft considers exploitation of the following vulnerabilities less likely:

CVE-2026-109459 and CVE-2026-119967 affect Windows Message Queuing Queue Manager. CVE-2026-109459 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.1. CVE-2026-119967 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 8.1.

CVE-2026-110043, CVE-2026-110068 and CVE-2026-111309 affect Microsoft Office Outlook. CVE-2026-110043 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-110068 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 8.8. CVE-2026-111309 is a remote code execution vulnerability involving Release of Invalid Pointer or Reference and has a CVSS base score of 8.8.

CVE-2026-110047, CVE-2026-110067, CVE-2026-111285 and CVE-2026-124185 affect Microsoft Office Word. CVE-2026-110047 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 8.8. CVE-2026-110067 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 8.8. CVE-2026-111285 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-124185 is a remote code execution vulnerability involving Use of Uninitialized Resource and has a CVSS base score of 7.5.

CVE-2026-111289 and CVE-2026-120003 affect Microsoft Office. CVE-2026-111289 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 8.8. CVE-2026-120003 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8.

CVE-2026-112967 affects Windows Xbox Live Networking Service. CVE-2026-112967 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 9.8.

CVE-2026-113752 affects Windows Print Spooler Components. CVE-2026-113752 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 7.5.

CVE-2026-113753, CVE-2026-113856, CVE-2026-113860, CVE-2026-113861, CVE-2026-113865, CVE-2026-119947, CVE-2026-119960 and CVE-2026-113864 affect Windows Hyper-V. CVE-2026-113753 is an elevation of privilege vulnerability involving Untrusted Pointer Dereference and has a CVSS base score of 8.2. CVE-2026-113856 is an elevation of privilege vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 7.8. CVE-2026-113860 is an elevation of privilege vulnerability involving Use After Free and has a CVSS base score of 7.0. CVE-2026-113861 is an elevation of privilege vulnerability involving Use After Free and has a CVSS base score of 7.5. CVE-2026-113865 is an elevation of privilege vulnerability involving Time-of-check Time-of-use (TOCTOU) Race Condition and has a CVSS base score of 7.8. CVE-2026-119947 is an elevation of privilege vulnerability involving Use After Free and has a CVSS base score of 7.5. CVE-2026-119960 is an elevation of privilege vulnerability involving Use of Uninitialized Resource and has a CVSS base score of 7.5. CVE-2026-113864 is an elevation of privilege vulnerability involving Use After Free and has a CVSS base score of 6.4.

CVE-2026-113825 affects Windows SMB Server Network Transport Driver (srvnet.sys). CVE-2026-113825 is a remote code execution vulnerability involving Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') and has a CVSS base score of 7.5.

CVE-2026-113859 affects Windows TCP/IP. CVE-2026-113859 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 7.5.

CVE-2026-114160 affects Azure Managed Grafana. CVE-2026-114160 is an elevation of privilege vulnerability involving Server-Side Request Forgery (SSRF) and has a CVSS base score of 9.8.

CVE-2026-114169 affects Windows Raw Image Extension. CVE-2026-114169 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8.

CVE-2026-116710, CVE-2026-119963 and CVE-2026-119964 affect Windows Message Queuing. CVE-2026-116710 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.1. CVE-2026-119963 is a remote code execution vulnerability involving Double Free and has a CVSS base score of 8.1. CVE-2026-119964 is a remote code execution vulnerability involving Double Free and has a CVSS base score of 8.1.

CVE-2026-116928 affects Microsoft Windows Search Component. CVE-2026-116928 is a remote code execution vulnerability involving Out-of-bounds Write and has a CVSS base score of 9.8.

CVE-2026-118145 affects Windows Function Discovery SSDP Provider. CVE-2026-118145 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 7.5.

CVE-2026-118292, CVE-2026-118296, CVE-2026-118297, CVE-2026-118701, CVE-2026-118702, CVE-2026-118711, CVE-2026-118713, CVE-2026-118730, CVE-2026-120786, CVE-2026-120788, CVE-2026-120789 and CVE-2026-124170 affect Microsoft Office Excel. CVE-2026-118292 is a remote code execution vulnerability involving Stack-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-118296 is a remote code execution vulnerability involving Double Free and has a CVSS base score of 8.8. CVE-2026-118297 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-118701 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-118702 is a remote code execution vulnerability involving Double Free and has a CVSS base score of 8.8. CVE-2026-118711 is a remote code execution vulnerability involving Stack-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-118713 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 8.8. CVE-2026-118730 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 8.8. CVE-2026-120786 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-120788 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-120789 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8. CVE-2026-124170 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 7.5.

CVE-2026-118737 affects Windows Remote Procedure Call Runtime. CVE-2026-118737 is a remote code execution vulnerability involving Improper Verification of Cryptographic Signature and has a CVSS base score of 8.1.

CVE-2026-119382 affects Windows TPM. CVE-2026-119382 is an elevation of privilege vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 7.8.

CVE-2026-119951 affects Windows Deployment Services. CVE-2026-119951 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 8.1.

CVE-2026-119957 affects Windows Remote Desktop Services. CVE-2026-119957 is an elevation of privilege vulnerability involving Double Free and has a CVSS base score of 7.8.

CVE-2026-119958 affects Windows LDAP - Lightweight Directory Access Protocol. CVE-2026-119958 is a remote code execution vulnerability involving Out-of-bounds Write and has a CVSS base score of 9.8.

CVE-2026-119961 affects Windows Internet Information Services. CVE-2026-119961 is a remote code execution vulnerability involving Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') and Use After Free and has a CVSS base score of 8.1.

CVE-2026-119962 affects Windows Cred SSProvider Protocol. CVE-2026-119962 is a remote code execution vulnerability involving Double Free and has a CVSS base score of 8.1.

CVE-2026-119966 and CVE-2026-125137 affect Windows Graphics Kernel. CVE-2026-119966 is an elevation of privilege vulnerability involving Integer Overflow or Wraparound and has a CVSS base score of 7.5. CVE-2026-125137 is an elevation of privilege vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 7.8.

CVE-2026-119969 affects Graphic Fonts. CVE-2026-119969 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8.

CVE-2026-120005 affects Microsoft Office PowerPoint. CVE-2026-120005 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8.

CVE-2026-122194 affects Microsoft Defender. CVE-2026-122194 is a remote code execution vulnerability involving NULL Pointer Dereference and has a CVSS base score of 8.8.

CVE-2026-125136 affects Windows Network Connected Devices Auto-Setup Service. CVE-2026-125136 is a remote code execution vulnerability involving Heap-based Buffer Overflow and has a CVSS base score of 8.8.

CVE-2026-125134 affects Windows Function Discovery Resource Publication. CVE-2026-125134 is a remote code execution vulnerability involving Use After Free and has a CVSS base score of 7.5.

CVE-2026-113749 affects Microsoft Windows Codecs Library. CVE-2026-113749 is a remote code execution vulnerability involving Heap-based Buffer Overflow and Integer Overflow or Wraparound and has a CVSS base score of 7.5.

CVE-2026-109469 affects Entra Device Registration. CVE-2026-109469 is an elevation of privilege vulnerability involving Authorization Bypass Through User-Controlled Key and has a CVSS base score of 10.0.

Other critical vulnerabilities:

CVE-2026-119990 affects Azure OpenAI. CVE-2026-119990 is an elevation of privilege vulnerability involving Missing Authentication for Critical Function and has a CVSS base score of 9.8.

Talos would also like to highlight the following "important" vulnerabilities as Microsoft has determined that their exploitation is "more likely:"

CVE-2026-105501: Windows Installer Elevation of Privilege Vulnerability

CVE-2026-105524: Windows Management Instrumentation Elevation of Privilege Vulnerability

CVE-2026-109473: Windows Kernel Elevation of Privilege Vulnerability

CVE-2026-112745: Azure DevOps Server Information Disclosure Vulnerability

CVE-2026-112759: Windows Task Scheduler Elevation of Privilege Vulnerability

CVE-2026-112791: Windows Print Spooler Components Elevation of Privilege Vulnerability

CVE-2026-112798: Windows NetBIOS Elevation of Privilege Vulnerability

CVE-2026-112811: Windows Print Spooler Components Elevation of Privilege Vulnerability

CVE-2026-112970: Windows SMB Client Elevation of Privilege Vulnerability

CVE-2026-113819: Desktop Window Manager Elevation of Privilege Vulnerability

CVE-2026-116714: Windows AppX Deployment Service Elevation of Privilege Vulnerability

CVE-2026-119389: Windows Storage Elevation of Privilege Vulnerability

CVE-2026-119398: Windows Installer Elevation of Privilege Vulnerability

CVE-2026-119818: Windows Text Services Framework Elevation of Privilege Vulnerability

CVE-2026-119886: Windows Telephony Service Elevation of Privilege Vulnerability

CVE-2026-119892: Windows Installer Elevation of Privilege Vulnerability

CVE-2026-119903: Windows Installer Elevation of Privilege Vulnerability

CVE-2026-119992: Windows HTTP.sys Elevation of Privilege Vulnerability

CVE-2026-121662: Visual Studio Code Remote Code Execution Vulnerability

CVE-2026-121663: Visual Studio Code Security Feature Bypass Vulnerability

CVE-2026-122175: Windows Autopilot Elevation of Privilege Vulnerability

CVE-2026-83563: Winlogon Elevation of Privilege Vulnerability

CVE-2026-88230: Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability

CVE-2026-88238: Windows Camera Frame Server Monitor Elevation of Privilege Vulnerability

CVE-2026-88242: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

CVE-2026-94514: Windows Kernel Elevation of Privilege Vulnerability

CVE-2026-95874: Xbox Gaming Services Elevation of Privilege Vulnerability

CVE-2026-95935: Windows Graphics Kernel Elevation of Privilege Vulnerability

CVE-2026-95963: Data Sharing Service Client Elevation of Privilege Vulnerability

CVE-2026-95983: Windows Graphics Kernel Elevation of Privilege Vulnerability

CVE-2026-95988: Windows Kernel Elevation of Privilege Vulnerability

CVE-2026-95989: vhdmp.sys Elevation of Privilege Vulnerability

CVE-2026-96077: Windows TCP/IP Denial of Service Vulnerability

CVE-2026-96126: Windows Graphics Kernel Elevation of Privilege Vulnerability

CVE-2026-97013: Windows Shell Elevation of Privilege Vulnerability

CVE-2026-119853: Remote Access API Elevation of Privilege Vulnerability

CVE-2026-88235: Servicing Stack Updates Elevation of Privilege Vulnerability

A complete list of all the other vulnerabilities Microsoft disclosed this month is available on its update page.

In response to these vulnerability disclosures, Talos is releasing a new Snort ruleset that detects attempts to exploit some of them. Please note that additional rules may be released at a future date, and current rules are subject to change pending additional information. Cisco Secure Firewall customers should use the latest update to their ruleset by updating their SRU. Open-source Snort Subscriber Ruleset customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.

Snort 2 rule coverage: 1:67457, 1:67456, 1:67459, 1:67458, 1:67463, 1:67462, 1:67461, 1:67460, 1:67455, 1:67454, 116:96, 116:97, 1:67445, 1:67444, 1:67451, 1:67450, 1:67447, 1:67446, 1:67449, 1:67448, 1:67469, 1:67468, 1:67465, 1:67464, 1:67471, 1:67470, 1:67475, 1:67474, 1:67473, 1:67472, 1:67484, 1:67483, 1:67254, 1:67255

Snort 3 rule coverage: 1:301740, 1:301741, 1:301743, 1:301742, 1:301739, 116:96, 116:97, 1:301734, 1:301737, 1:301735, 1:301736, 1:301746, 1:301744, 1:301747, 1:301749, 1:301748, 1:301751, 1:301685

from Cisco Talos Blog https://ift.tt/boZXMj6
via IFTTT

Detecting sleeper agents hiding in AI model neurons

Microsoft Research has released new threat research detailing how a capable agent model could be turned into a sleeper agent by editing fewer than 10 neurons to inject a short payload. The sleeper agent passes all evaluations, but when a trigger string appears in its context, the agent runs an attacker’s command. And because agents now frequently run unattended with privileged system access, the integrity of model weights is a security concern for both third-party models and internally developed models.

Key findings from Microsoft Research include:

• Software abuse and manipulation are familiar threats. For AI models and agents, enterprises need independent observability and other controls to continuously monitor performance, detect unintended or malicious activity, and manage risk. Satya Nadella recently outlined this approach in a blog post.
• A backdoored model can pass evaluations. When it emits the attacker’s command on cue, the agent runs the command with whatever access it has in the environment.
• The attack needs inference-only compute. If a machine has enough RAM to run a model, it has enough resources to weight-space backdoor it.
• Claude Code with Opus 4.5 discovered most of this threat autonomously.

Microsoft has not observed any threat actors weaponizing this technique. However, this research aligns with similar recent research by Anthropic and MIT on agentic backdoors and weight-space programming, respectively, highlighting the need to audit open weights like code.

Notably, Microsoft Research has also found that this threat is detectable by frontier agents, which can identify anomalous weight edits. Using frontier agents as auditors can help automate the defense against this threat. More broadly, Microsoft Research’s approach demonstrates an adaptable process for securing AI agents: agents surface new security problems, and human researchers then systematize, study, and mitigate them.

Learn more from the Microsoft Research Blog: Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents.

Mitigation and protection guidance

Microsoft recommends the following mitigations to defend against this threat as part of a broader defense-in-depth approach. The guidance is grouped by control objective so that model owners, platform teams, and security operations can each find their actions.

Audit model weights before deployment and after every update

• Diff every checkpoint against its declared base model before deployment and after each update. Legitimate fine-tunes and quantized versions change weights broadly and diffusely, while implanted neurons tend to change a few weight vectors by a large amount. Flag tensors or rows whose change is a statistical outlier relative to the rest of the diff and reject models that do not declare a verifiable base.
• Use frontier AI agents as auditors in the model intake pipeline. Microsoft Research found they are highly effective at finding anomalous structure in weights that manual inspection misses, which makes this step automatable at scale.
• Complement weight diffing with behavioral backdoor scanning of open-weight models, as described in Microsoft’s research on detecting backdoored language models at scale.
• Record audit results alongside the model in the registry, and state clearly to internal consumers that passing an audit reduces risk but does not guarantee safe behavior.

Secure model hubs and publishers

• Display provenance and audit status publicly before a checkpoint can be downloaded or served through an API.
• Scan every upload for anomalous neurons, weight patterns or behaviors, and state clearly that third-party checkpoints can be unsafe and that passing an audit does not guarantee safe behavior.

Treat every third-party model as untrusted until audited

• Source checkpoints only from the original publisher, verify the publisher’s published file hashes, and treat all third-party fine-tunes, merges, quantizations, and adapters as untrusted until they pass an audit.
• Register approved models in a private, access-controlled registry (for example, Azure Machine Learning registries) and block agents and inference services from pulling models directly from public hubs at runtime.
• Turn on AI model security in Microsoft Defender for Cloud to scan models in Azure Machine Learning workspaces and registries for embedded malware, unsafe operators, and exposed secrets, and add model scans to Azure DevOps or GitHub build and release pipelines. Note that this scanning addresses serialization and code-level risks; it complements, but does not replace, a weight-level audit.
• Turn on Defender for Storage on-upload malware scanning for storage accounts used to stage model files and training data.

Red team for hidden triggers

• Add trigger-hunting and backdoor scenarios to your AI red team plan. Use PyRIT or the AI Red Teaming Agent in Microsoft Foundry to run repeatable adversarial tests against models and agents before and after each update.

Contain what an agent can do if its model is compromised

• Run agents with least privilege. Give each agent its own Microsoft Entra Agent ID, scope its permissions to the minimum set of resources it needs, and use Conditional Access for agents to lblock unapproved or high-risk agent identities.
• Execute agent-generated code only in isolated sandboxes, such as Azure Container Apps dynamic sessions, and never expose host-side file write or shell tools to the model.
• Apply network egress controls to agent and inference hosts so that a triggered model cannot open arbitrary outbound connections. Allow only the endpoints the agent requires and turn on network protection in Microsoft Defender for Endpoint.
• Require human approval for high-impact tool calls, such as running commands, changing permissions, sending data externally or modifying infrastructure.
• Apply attack surface reduction rules to devices that host local agents and inference servers, starting in audit mode.

Detect and block malicious agent behavior at runtime

• Turn on Microsoft Defender security for AI agents and configure real-time protection rules so Defender can audit and block risky tool invocations, secret exfiltration, and evasion techniques for Microsoft Foundry, Copilot Studio and Agent 365 agents, and runtime protection for local agents through Defender for Endpoint.
• Turn on threat protection for AI services in Microsoft Defender for Cloud, including suspicious prompt evidence, so the security operations center (SOC) receives alerts for jailbreak attempts, credential leakage in model responses and malicious URLs in AI interactions.
• Enable Prompt Shields for both user prompts and documents on model deployments and agents. Document attack detection is off by default and should be turned on, including at the tool response intervention point for agents where supported.
• Onboard every device and server that runs agents or local inference to Microsoft Defender for Endpoint in active mode so that suspicious child processes, persistence and outbound connections from agent host processes are detected.

Maintain inventory and governance of models and agents

• Use the AI agent inventory in the Microsoft Defender portal to discover agents, their tools, identities, and risk indicators.
• Use AI security posture management in Defender for Cloud to build an AI bill of materials (AI BOM) across Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP), so you know which models are deployed where.
• Use Microsoft Defender for Cloud Apps and Microsoft Purview DSPM for AI to discover, sanction or block generative AI apps, and to monitor sensitive data in AI interactions.
• Map controls to the Microsoft catalog of AI defense capabilities, which groups supply-chain provenance, model hardening, runtime isolation and monitoring into a single framework aligned to MITRE ATLAS and the OWASP Top 10 for LLM Applications.

Learn more

For the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog.

To get notified about new publications and to join discussions on social media, follow us on LinkedIn, X (formerly Twitter), and Bluesky.

To hear stories and insights from the Microsoft Threat Intelligence community about the ever-evolving threat landscape, listen to the Microsoft Threat Intelligence podcast.

The post Detecting sleeper agents hiding in AI model neurons appeared first on Microsoft Security Blog.

from Microsoft Security Blog https://ift.tt/YmTS43c
via IFTTT

Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones

A flaw in Git can let a malicious repository run an attacker's code on a computer that clones it recursively, together with its submodules. The Git project fixed it this week in Git 2.56.1, with matching fixes for the 2.50 through 2.55 series in 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1 and 2.55.1.

The flaw, tracked as CVE-2026-111760, is an integer truncation in how Git handles its index. An extremely long path in a repository can pass Git's safety check, but Git then writes it to disk under a shorter name that an attacker can set to .git.

This lets an attacker replace a submodule's .git file with a symbolic link to a folder holding malicious hooks or configuration. Hooks are programs Git runs at set points, so once Git uses that folder, the attacker's code can run.

Submodules matter here because Git refuses to replace a .git folder with a symbolic link, but in a freshly cloned submodule, .git is a file.

The fixed versions, listed in the Git project's release announcement, refuse such extremely long paths before their length can be cut short.

GitHub, which ships Git in its own tools, explained the fixes in a detailed write-up. It advises installing a fixed version from your operating system or Git distributor, and updating any app that ships its own copy of Git.

The company has already applied the fixes to github.com and GitHub Enterprise Cloud. For GitHub Enterprise Server, they are in versions 3.19.15, 3.20.11, 3.21.9 and 3.22.4.

Fixed versions of GitHub Desktop and the GitHub Copilot app are being prepared. GitHub Codespaces and GitHub Actions will also get the fixed Git.

Git for Windows had not released a version based on Git 2.56.1 as of Tuesday at 19:09 UTC, a check of its release tags by The Hacker News found.

Until a fixed version is installed, GitHub suggests these steps, which do not replace the fixes:

• Clone only from servers you trust.
• Do not recursively clone repositories you do not trust.
• Do not merge content or tags you do not trust.
• Do not process binary patches or fast-import streams from sources you do not trust.

The Git releases also fix five other flaws:

• CVE-2026-113408: When someone clones an empty repository over Git protocol v2, a malicious server can send a branch name that contains path traversal. With the files reference backend, a later update to that branch can then write outside Git's reference folder.
• CVE-2026-114467: Merging a tag that carries more than two GPG signatures corrupts Git's stack memory and can cause a denial of service. Hosting services that run such merges for users may also be affected.
• CVE-2026-114469: A binary patch that expands to a very large size can get past Git's patch size limit of about 1 GiB and crash Git with an out-of-bounds read.
• CVE-2026-105437: A very large merge, with many conflicts and a large conflict-marker-size attribute, can make Git write past the end of a buffer that is too small, corrupting heap memory.
• CVE-2026-114466: Three git fast-import features, rewrite-submodules-from, rewrite-submodules-to and export-pack-edges, could be used to read arbitrary files or to create files and add data to them. Git now rejects them in an input stream unless --allow-unsafe-features is set.

GitLab, which assigned CVE-2026-105437, said code-hosting servers are most likely to be targeted through git merge-tree. A server may run that command to check whether a pull or merge request can be merged.

The conflict-marker-size attribute can be set in a .gitattributes file committed to a repository. If a server reads attributes from the repository, any user who can push branches and open a pull or merge request can trigger the flaw.

As a workaround for this flaw, servers that cannot upgrade yet can add conflict-marker-size=7 to each repository's info/attributes file, or turn off those merge checks for untrusted repositories.

from The Hacker News https://ift.tt/qZW0TXi
via IFTTT

SGLang RCE Exploit Breaches NEAR AI, Steals Data From 18 Agents and About 100 Users

An attacker exploited a remote code execution flaw in SGLang, an open-source inference engine, and ran code on one of NEAR AI's inference servers last Sunday.

The attacker could also have seen requests being processed on that server that day, including requests sent in confidential mode, the company said earlier this week. That mode processes requests inside a trusted execution environment (TEE) designed to keep them private even from the company itself.

But the TEE "does not protect against a vulnerability in the software running inside the environment," the company said. SGLang runs inside the TEE, which is how the attacker could reach requests there.

That access has since been closed, but not before the attacker moved further into the company's systems.

The attacker reached an internal system behind Private Chat, a product the company had already deprecated. So far, the company has confirmed that the attacker downloaded account details for about 100 users there. These are email addresses and names, and for some accounts, plan and balance information.

The company found no sign that stored Private Chat conversations or uploaded files were accessed.

The attacker also reached 18 AI agents on an older deployment of NEAR AI Agents that did not run inside the company's TEE. From those agents, the attacker took data including chat history, settings and logs.

Two customers' NEAR AI Cloud API keys were exposed in logs. The company has revoked both.

After detecting the attack, the company revoked all active sessions and administrator credentials, replaced all agent tokens and took Private Chat offline. It also deployed a fix for the SGLang flaw on all of its inference servers, rotated its remaining credentials and completed a full forensic review, according to its incident report.

Access to its NEAR AI Cloud service has been restored. The company reported the flaw to the SGLang project. It has not identified the flaw by CVE number, named the affected SGLang versions, or said whether the project has released a fix.

The company has contacted users whose account details or agents it confirmed were accessed. Affected users heard directly from security@near.ai, with the steps that apply to them. As a precaution, the company asks users to be careful with messages about their account or balance that they did not ask for.

In a follow-up post yesterday, it said users who have not heard from it do not need to do anything. It has not said whether people whose requests passed through the affected server last Sunday were among those contacted.

In an October 15 technical write-up, Brave, the browser maker, said its Leo assistant runs chats with the GLM 5.3 Flash model inside a TEE operated by NEAR AI.

NEAR AI has not said whether the affected server handled any of those chats.

from The Hacker News https://ift.tt/qs1W0gl
via IFTTT

Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access

French software company Vates VMS has warned of a critical security vulnerability in Xen Orchestra that it said is being actively exploited in the wild.

The authentication bypass flaw, which does not yet have a CVE identifier, is tracked as VSA-2026-062.

"REST cookie parsing turns authenticationToken=j:%7B%7D into {}," Vates VMS said in an alert. "REST authentication passes that object to the XO token provider without requiring a string."

"The token collection treats {} as an unfiltered lookup and returns its first token; the provider authenticates as that token's owner if it is unexpired. The authenticated /rest/v0/users/me/authentication_tokens route then returns reusable login token IDs."

In other words, the vulnerability can allow an attacker to bypass authentication by sending a specially crafted cookie and perform arbitrary actions with "Admin" privileges, ultimately resulting in arbitrary code execution on managed pools and a full XCP-ng node takeover as root.

Vates VMS said it's seeing the vulnerability being actively exploited by a threat actor from the following IP address and TOR domain -

• 91.211.251[.]112:8001, which has been flagged as a RedLine Stealer command-and-control (C2) server on VirusTotal
• ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid[.]onion:3333

It's unclear when the activity started and if the vulnerability was exploited as a zero-day.

Other indicators of compromise are listed below -

• HTTP requests containing authenticationToken=j:%7B%7D or authenticationToken=j:{}
• A running virtual machine named pivot2
• Virtual machines configured using "hvm_serial: file" parameter
• Suspicious files named /etc/cron.d/zz-ustar2, /etc/cron.d/zz-ustar, /.ustar5, and /.ustar6

The issue has been addressed in Xen Orchestra 6.9.1 and 6.10.0 for the stable and latest channels, as well as xo-server versions 5.211.2 and 5.213.1. If immediate patching is not an option, the following mitigations are advised -

• Avoid exposing Xen Orchestra instances on the internet
• Block the IP address and domain associated with malicious activity
• Block the empty token in a web application firewall (WAF) or a reverse proxy
• Rotate all passwords and secrets in Vates VMS if indicators of compromise are detected

Filip Magic (@mad31k) and Christoffer Olsen from TDC NET Security have been credited with discovering and reporting the flaw.

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

from The Hacker News https://ift.tt/NhZxkHR
via IFTTT

Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem

Three distinct threat activity clusters with shared infrastructure and malware code similarities have been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe over the past year.

Check Point Research is tracking the clusters under the names SilentDelivery, OceanGate, and DarkWire. Although initially assumed to be independent sets of attacks, each with its own backdoors and post-exploitation tooling, they have all been linked through a malware ecosystem called Sparrow.

The entity behind the Sparrow framework has been codenamed CopperDragon, and is assessed to be a digital quartermaster developing tools for China-nexus threat actors, including FamousSparrow, Earth Estries, Tropic Trooper, UAT-9244, and UAT-8302.

"Each cluster employed a different toolset and different initial access techniques, including compromising internet-facing infrastructure and highly selective watering hole attacks," Check Point said in a technical report published today. "The compromised websites that were used for watering hole attacks were of government, shipping, and IT and research sectors."

Attacks mounted by FamousSparrow are known for deploying backdoors like SparrowDoor (and its variants Crowdoor and TernDoor), SparroWocky, and HemiGate. It's also assessed to share some degree of overlap with Salt Typhoon. However, the precise nature of the relationship remains unclear.

The cyber espionage ecosystem linked to CopperDragon is driven by three prominent clusters -

• SilentDelivery (Beginning in early 2026), which conducts highly selective watering hole attacks targeting Europe and Asia that distribute a backdoor called SquadC (aka SquawkDoor) through trojanized MSI installers masquerading as certificate repair utilities
• OceanGate (2025-2026), which primarily focuses on Asian organizations with a variant of SparrowDoor after obtaining initial access via internet-facing Linux servers and then moving laterally into Windows environments
• DarkWire (Mid 2025), which targets telecommunications providers and government organizations across Latin America using backdoors called CopperDoor (aka SparroWocky) and CopperDNS

SilentDelivery

The SilentDelivery chain begins with the attacker injecting heavily obfuscated JavaScript into legitimate websites frequented by their intended targets. Visitors to the sites are greeted by a Google Chrome SSL certificate warning that instructs users to install a "Certificate Fix" utility to restore access.

The so-called utility, once deployed, delivers either SquadC or a SparrowDoor variant. All the compromised websites have been found to be related to government, shipping, IT, and research sectors in the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong, and Indonesia.

According to a report published by Positive Technologies in August 2026, there are indications that the campaign has also targeted entities in Egypt and the Philippines using this method.

"The JavaScript injected into the compromised websites is heavily obfuscated using jsjiami, a publicly available JavaScript obfuscation service," Check Point said. "It first checks whether the user is running Windows and, in some cases, verifies that the website’s domain matches the intended compromised domain."

The script then repeatedly sends status-check requests to a command-and-control (C2) server to fingerprint the user based on IP and geolocation, and ultimately decide whether to continue the attack and serve the fake warning.

Source: Positive Technologies

Written in C/C++, SquadC is a Windows backdoor that enables initial foothold over the infected host. It establishes persistence by means of a Windows Registry Run key that masquerades as a Windows update assistant. Further analysis has uncovered that the malware is also distributed via phishing emails targeting Indonesian organizations.

The phishing email comes with a Windows Shortcut (LNK) disguised as a PDF document, which, when opened, abuses the legitimate "ftp.exe" binary to run a batch script that's responsible for displaying an empty file as a decoy, while launching SquadC via DLL sideloading.

OceanGate

The OceanGate operation, on the other hand, has been observed targeting both Windows and Linux environments, deploying previously undocumented tooling to maintain access, move laterally across the network, and exfiltrate sensitive data.

The Linux phase of the attack involves two new backdoors -

• AnnobinDoor, a Go-based backdoor that supports remote access, interactive shell, file management, SOCKS proxying, SSH tunneling, port forwarding, and reverse connections.
• SparrowShell, a modular Linux backdoor that shares overlaps with its Windows counterpart, SparrowDoor

"After harvesting credentials from multiple users and establishing a strong foothold in the Linux environment, the actor moved into the Windows environment," Check Point explained. "The actor attempted to log in to several Windows machines over RDP, trying different passwords until it successfully authenticated with an administrator account."

This step is followed by the deployment of bespoke post-exploitation tools and a variant of SparrowDoor -

• CopperAdu, a post-exploitation tool which configures a compromised Windows machine for remote administrative access
• CopperList, a Windows reconnaissance tool for collecting host information, disk details, and a recursive file inventory, including file paths, sizes, and timestamps
• CopperLogger, a Raw Input-based keylogger to capture keyboard input events, along with monitoring clipboard activity, active window titles, and associated process names and paths
• CopperLsa, a utility that collects passwords, hashes, and authentication tokens from NTLM and Kerberos

What's more, the threat actor has been found incorporating kernel rootkits and kernel-level access capabilities into SparrowDoor and SparrowShell to evade defenses through process hiding and to capture and manipulate network packet capture using WinDivert drivers.

"The actor abused the driver to convert SparrowDoor into a passive backdoor that intercepts and manipulates packets at the kernel level, making its traffic less visible," Check Point said. "This allows the backdoor to listen internally on one port while receiving connections through an externally accessible port, such as 443, that is already used by a legitimate service."

"The backdoor applies a strict filter to intercept connections from a specific source IP address to the legitimate service's port. It manipulates the packet and rewrites the destination port to the backdoor’s internal listening port, typically a high port such as 49628. For response traffic, it rewrites the source port back to the external service port, making the responses appear to originate from the legitimate service."

Interestingly, SparrowShell shares code- and infrastructure-level similarities with a malware called Mélofée that was first described by ExaTrack in March 2023 as based on the open-source Reptile rootkit. This has raised the possibility that CopperDragon is also behind the development and supply of Mélofée.

DarkWire

The third and last cluster of activity centers around Latin America, with a particular focus on telecommunications operators and government entities. These attacks led to the deployment of two newly identified backdoors called CopperDoor and CopperDNS as a possible replacement for SparrowDoor.

Also supporting these operations is a set of custom tools -

• CopperLoader, a reflective loader typically deployed through DLL sideloading and is used to deliver additional tools, including CopperDoor, CopperDNS, CopperProxy, and CopperLsass
• CopperDoor, a memory-resident modular backdoor
• CopperDNS, a CopperDoor variant that communicates through DNS tunneling using MX queries
• CopperProxy, a SOCKS5 proxy
• PyProxy, a lightweight UDP relay written in Python
• CopperLsass, a dedicated module for dumping the LSASS process for credential harvesting

"The operation heavily relies on DLL sideloading as a primary execution technique, often abusing executables that are not widely observed among other threat actors in the wild," Check Point said. "To minimize their footprint, the operators deliberately avoided creating new directories on disk, instead placing their tools within existing system paths."

"CopperDoor infrastructure demonstrated a higher level of operational security. Most IP addresses were located in Latin America, often within the same country as the victim organization. This proximity likely helps the malicious traffic blend in with legitimate network activity and reduces the chances of detection."

from The Hacker News https://ift.tt/Kmz3yLi
via IFTTT

Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America

The threat actor known as Blind Eagle has resurfaced with a new campaign targeting organizations in Latin America through judicial and administrative-themed phishing lures to deliver a remote access trojan (RAT) that shares its lineage with AsyncRAT and DCRat.

"The campaign uses Portuguese and Spanish lures that resemble court notifications, fiscalía notices, tutela proceedings, and administrative documents," Zenox said in a report shared with The Hacker News.

Assessed to be a Spanish-speaking group and active since 2018, Blind Eagle (aka APT-C-36) has a track record of using spear-phishing lures to distribute commodity RATs like AsyncRAT, BitRAT, Lime RAT, NjRAT, Quasar RAT, and Remcos RAT.

Attack chains begin with phishing emails targeting individuals who handle cases, contracts, judicial, or institutional service requests to trick them into opening a malware-laced attachment.

One email containing a Colombian judicial-themed XHTML file has been identified as a weaponized Scalable Vector Graphics (SVG) image that renders a bogus web page impersonating Colombia's Fiscalía General de la Nación, also referred to as the Office of the Attorney General.

The web page, for its part, employs a technique known as HTML smuggling to assemble the next-stage ZIP archive payload locally in the web browser using ZipCrypto, thereby circumventing email security controls.

Present within the ZIP archive is a JavaScript dropper that masquerades as Network Configuration Auditor version 2.7.298. The JavaScript code conducts environment reconnaissance, and collects details such as system version, network profile, installation date, memory size, computer name, environment variables, and directories localized in Portuguese and Spanish.

Upon execution, it launches a Visual Basic Script that performs Windows Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW) bypass, while displaying a fake criminal-citation page as a distraction mechanism.

In parallel, the malware also takes steps to delete the original XHTML artifact, clears Mark of the Web (MotW) metadata, and sets up persistence on the host under the Windows Startup folder so that it's automatically executed on system startup.

The attack culminates with the use of PowerShell to decode and launch the final RAT payload in memory. The trojan is an AsyncRAT fork with DCRat lineage based on code structure, configuration, build characteristics, and observed behavior.

Although there is no evidence that these attacks have been successful against real-world targets, a successful compromise could result in environment reconnaissance, document collection, remote access, keystroke and screen capture, surveillance, and data exfiltration over an encrypted channel.

"The targeting of judicial, fiscal, administrative and educational organizations gives the operation access to highly sensitive legal, financial and institutional information," Zenox said.

"Combined with the Portuguese and Spanish lures, Brazilian infrastructure, operational timezone and regional victimology, these elements establish the campaign as an APT-C-36 operation conducted through a Brazilian operational cluster."

from The Hacker News https://ift.tt/xBWmvfg
via IFTTT

Fireworks AI Breach Widens to Expose Customer Billing Data and Incomplete Model Weights

Fireworks AI disclosed on Monday that its investigation into a security incident first reported early last month uncovered further malicious activity, affecting account and billing information, alongside secrets, datasets, and incomplete models for a "limited set of accounts."

In a notice published on October 10, 2026, the company said it detected unauthorized use of internal Fireworks credentials that allowed an unauthorized third-party to access environment variables used in evaluation jobs in a limited number of customer accounts. The activity was detected on October 6, 2026, at 9 a.m. PDT.

At that time, the AI infrastructure provider said it only found evidence that environment variables, including API keys and tokens stored as secrets, were captured in certain affected accounts, adding that there were no signs that customer models, datasets, training data, inference traffic, or personal information were accessed.

In response to the incident, Fireworks AI took the step of revoking the compromised internal credentials and rotating service account tokens, along with affected Fireworks API keys and keys created by the threat actor.

The latest bulletin from the company reveals that the scope of the breach may have been broader than previously thought. The company said attackers reached its development environment via an unnamed third-party cloud provider that hosted Fireworks research and development (R&D) machines on October 23, 2026.

"On October 24, the unauthorized third party used it to reach Fireworks development machines and then run an unauthorized workload that led to additional customer data impact," it added. "As of October 25, we have not detected further evidence of successful unauthorized access by the threat actor on the Fireworks platform customers use."

The breach is said to have provided access to the following types of information -

• Resource metadata: Fireworks resource identifiers, display names, descriptions, and creation time
• Billing information: billing and shipping addresses, invoice and payment history, account balance, and credit usage
• Model weights and datasets: a subset of incomplete model weights and datasets for certain customers

Fireworks AI said payment card numbers are not stored by Fireworks and were not impacted by the security incident. It also said it's alerting customers whose data was impacted.

The company also noted that it has implemented security hardening procedures, such as credential revocation and rotation; isolating affected systems to prevent further unauthorized activity and lateral movement; tightening access controls; and improving its logging and monitoring systems.

"The evidence indicates links to a cybercriminal threat actor group, which is financially motivated and aimed at selling tokens from unauthorized access to large language models (LLMs) to illicit routing gateways," it said.

The activity is assessed to be part of an emerging threat known as LLMjacking, which refers to the act of hijacking a victim's LLM through stolen credentials to fuel a criminal enterprise that thrives on peddling the access to other threat actors, while leaving the legitimate owner to pay the bill.

Last week, Google issued a warning that threat actors are increasingly targeting AI infrastructure for LLMjacking in North America, South America, and Asia Pacific across the financial services, retail, technology, and transportation sectors.

from The Hacker News https://ift.tt/79QX3MG
via IFTTT

Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Vulnerabilities

An iMessage flaw could let a remote attacker join a group chat and receive its messages, Apple said yesterday, and it released updates to fix it. The updates also fix a separate iMessage flaw that could let someone added to a group access messages sent before they joined.

As of today, other updates released yesterday for the iPhone XS, XS Max and XR, the iPad (7th generation) and some Apple Watch models do not list either fix.

The company's notes also do not say whether either flaw has been exploited, what an attacker would need, whether group members would see someone who joined this way, or whether every member must update to be protected.

The updates that fix the iMessage flaws also fix a flaw in Google's Brotli compression library. The notes do not mention any attacks using that flaw. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalog on October 27.

The flaw that could let a remote attacker join a group chat is tracked as CVE-2026-113961. It is an authorization issue that the updates fix through improved validation. The flaw involving earlier messages is CVE-2026-113960.

Which Updates Carry the Fixes

Each operating system version got its own update. The security advisory for iOS and iPadOS 27.2.1 describes all three flaws. The security releases list links to the notes for every update.

The iOS 18.7.12 notes and the watchOS 26.6.1 notes list other security fixes but not the iMessage or Brotli fixes.

The company does not say whether devices on those versions are affected by the three flaws. Its notes also offer no workaround for anyone who cannot update right away.

The Brotli flaw, CVE-2026-111497, is an out-of-bounds write in the library's decoder that could let malicious input corrupt memory. CISA's catalog entry for the Brotli decoder flaw names Google's Brotli as the affected product and says different products could use the component.

All nine updates fix Bluetooth and AirPlay flaws. Two could allow a malicious Bluetooth device, or an attacker within Bluetooth range, to pair with a device without user interaction. The notes do not say what a paired device could then do.

Two others could let an attacker bypass the limit on pairing code attempts, one from Bluetooth range and one from the same network. Another could let an attacker in Bluetooth range corrupt process memory.

from The Hacker News https://ift.tt/RyxOhkJ
via IFTTT

Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers

The Russia-aligned state-sponsored threat actor known as Turla (aka Snake) is wielding a previously undocumented cyber espionage toolset called Cereal that's used to break into victims' Microsoft Exchange servers with an aim to surreptitiously collect emails.

According to an ESET report shared with The Hacker News ahead of publication, the sophisticated and modular tool is designed for long-term intelligence gathering and has been observed against two governmental entities in Kazakhstan and Romania in late 2025.

"The Cereal toolset is a carefully constructed instrument for long-term, stealthy cyber espionage," the Slovakian cybersecurity company said. "It leaves little on disk, avoids external infrastructure that could be discovered and blocked, and conceals itself within legitimate Exchange processes."

"The Cereal toolset demonstrates that, for Turla, Exchange servers are not just mail servers – they are durable collection points, internal execution hubs, and a suitable environment for hiding sophisticated .NET tradecraft."

The toolset is a collection of interconnected components that are capable of running on Microsoft Exchange servers, receiving commands, executing them in memory, mapping the infected network, and harvesting emails of interest. The initial access vector used to deliver the malware is unknown, although the group is known to conduct spear-phishing, watering hole, and ISP-level adversary-in-the-middle (AitM) attacks.

Cereal gets its name from the fact that the tools make extensive use of serialization, which refers to the process of converting a data structure or an object's state into a format that can be easily stored, transmitted, and reconstructed.

A number of aspects make the malware stand apart -

• Absence of an external command-and-control (C2) infrastructure, instead abusing a compromised Exchange server for this purpose.
• Sending commands in the form of separate, compiled .NET programs.
• Using an automated email collection module, which is injected into legitimate Microsoft Exchange processes and is engineered to manipulate the email transport pipeline.

The combination of these techniques shows that the threat actor possesses a deep understanding of the internal workings of Microsoft Exchange, ESET added. The Cereal framework consists of eight moving parts that work together to provide the attackers with access to sensitive email data -

• CerealRunner, which is deployed by the operator and serves as a pathway for dropping additional components, including CerealLoader, CerealSprinter, CerealIron, and CerealMoth.
• CerealLoader, which loads and runs a .NET assembly from an encrypted file on disk, leading to the execution of CerealSprinter.
• CerealSprinter, which functions similarly to CerealRunner and is used to decrypt and run CerealNeuron, CerealHermit, and CerealBox.
• CerealIron, an injector that makes it possible to load and run .NET assemblies from non .NET processes.
• CerealMoth, which receives an assembly and a method name as inputs, loads the assembly, and runs the specified method.
• CerealNeuron, a passive backdoor that runs on a compromised Exchange Server and listens for incoming web requests on paths that appear like regular Exchange traffic to execute assemblies contained in CerealRunner binaries.
• CerealHermit, a variant of CerealNeuron that reads commands from encrypted files on disk and has no network functionality of its own.
• CerealBox, which is the email harvesting module that processes, filters, and collects email messages by injecting itself into the Exchange transport service ("EdgeTransport.exe").

Upon gaining visibility into the email flow, the malware looks for messages containing DOC, DOCX, or PDF attachments, and matches at least one of many hard-coded lists with sender addresses, recipient addresses, subject lines, or attachment names.

Emails that meet the filtering criteria are compressed, encrypted, and staged in files on disk, after which they are exfiltrated and deleted via CerealNeuron commands.

In the attack aimed at the Romanian government organization, CerealBox is said to have been configured to gather emails involving NATO and European Union institutional addresses, a pattern that aligns with Russia's strategic priorities.

The commands delivered as compiled .NET programs are handled by CerealRunner, which unpacks and executes the payloads in memory and then sends the results back to CerealNeuron for subsequent exfiltration to the threat actor in encrypted format.

The commands support retrieving mailboxes or specific messages; queuing Active Directory for computers, users, groups, and DNS records; running Windows Management Instrumentation (WMI) queries; extracting LSA Secrets; listing volume snapshots; and performing file operations.

"The sheer volume of near-identical binaries, each compiled for a specific task, strongly suggests that the operators have an internal framework that automates the compilation and packaging of commands," ESET researcher Matías Porolli said.

"Combined with a codebase built around modular, interchangeable components, the impression is one of a mature, well-engineered platform – rather than a loose collection of scripts."

from The Hacker News https://ift.tt/zX0SV1y
via IFTTT