Explore

Nessus Agent Vulnerability on Windows Allows System-Level Code Execution

Nessus Agent Vulnerability on Windows Allows System-Level Code Execution

A critical security vulnerability has been identified in Tenable's Nessus Agent for Windows, which could allow attackers to execute arbitrary code with SYSTEM privileges. This flaw involves a symlink attack, where attackers can manipulate file operations to delete critical system files, leading to full control over the affected machine. The vulnerability poses a significant threat to organizations using Nessus Agents for vulnerability assessments, especially those installed on high-value or internet-adjacent systems. Tenable has released a patch in version 11.1.3 to address this issue and urges immediate updates to mitigate risks.

Pack2TheRoot Vulnerability in Linux Allows Unprivileged Users Root Access

Pack2TheRoot Vulnerability in Linux Allows Unprivileged Users Root Access

A high-severity vulnerability known as 'Pack2TheRoot' has been identified in the PackageKit cross-distro package management system used in Linux. This flaw, tracked as CVE-2026-41651, is a time-of-check time-of-use (TOCTOU) race condition that allows unprivileged users to install packages with root privileges. The vulnerability affects multiple Linux distributions, including Ubuntu, Debian, and Fedora. It has been present in PackageKit since version 0.8.1, released 14 years ago. The flaw allows attackers to exploit the system by running transactions with corrupted flags, leading to unauthorized root access.

Firestarter Malware Persists Despite Cisco Firewall Patches

Firestarter Malware Persists Despite Cisco Firewall Patches

The Firestarter malware, associated with the ArcaneDoor threat actor, has been found to persist in Cisco's Firepower and Secure Firewall devices despite security patches released in September last year. This malware, identified as a Linux binary, embeds itself in the Firepower eXtensible Operating System (FXOS) base layer, surviving device reboots and evading detection. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the UK's National Cyber Security Centre (NCSC) have issued alerts, advising organizations to follow emergency directives, including physically disconnecting affected firewalls to disrupt the malware's persistence.

Cisco Confirms 'Firestarter' Malware Persists Despite Firewall Patches, Urges Hard Reboot

Cisco Confirms 'Firestarter' Malware Persists Despite Firewall Patches, Urges Hard Reboot

Cisco has acknowledged that the 'Firestarter' malware, deployed by the ArcaneDoor threat actor, remains active despite security patches released in September last year. This malware affects the Firepower and Secure Firewall devices by embedding itself as a Linux binary in the Firepower eXtensible Operating System (FXOS). It survives device reboots by copying itself to a log directory and manipulating the storage mount list. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and Britain's National Cyber Security Centre (NCSC) have named the malware 'Firestarter'. CISA advises organizations to perform a hard reboot by unplugging the devices to disrupt the malware's persistence routine.

Nessus Agent Vulnerability on Windows Allows Critical System Privilege Exploitation

Nessus Agent Vulnerability on Windows Allows Critical System Privilege Exploitation

Nessus Agent Vulnerability on Windows Allows Critical System Privilege Exploitation

BlackFile Group Intensifies Vishing Attacks on Retail and Hospitality Sectors

BlackFile Group Intensifies Vishing Attacks on Retail and Hospitality Sectors

Security researchers have identified a new extortion group, BlackFile, which has been targeting retail and hospitality businesses since February 2026. The group, linked to the activity cluster CL-CRI-1116, is known for its financially motivated attacks. Unlike other cybercriminals, BlackFile does not use custom malware but exploits legitimate internal resources and APIs. They employ vishing attacks, impersonating IT helpdesks to steal credentials and one-time passwords. The attackers use spoofed VoIP numbers and fraudulent Caller ID Names to conceal their identities. Once they gain access, they register new devices to bypass multi-factor authentication and maintain persistence. The group focuses on SaaS data discovery and API abuse, exfiltrating data through browsers or API exports. They demand ransom through random Gmail addresses or compromised employee emails, sometimes resorting to SWAT-ing to force payment.

Itron Discloses Cyber-Attack, Ensures Operations Remain Unaffected

Itron Discloses Cyber-Attack, Ensures Operations Remain Unaffected

Itron Discloses Cyber-Attack, Ensures Operations Remain Unaffected

Itron Discloses Cyber-Attack, Ensures Continued Operations

Itron Discloses Cyber-Attack, Ensures Continued Operations

Itron Discloses Cyber-Attack, Ensures Continued Operations

Itron Confirms Cyberattack, Potential Data Breach on Energy Management Systems

Itron Confirms Cyberattack, Potential Data Breach on Energy Management Systems

Itron Confirms Cyberattack, Potential Data Breach on Energy Management Systems

OpenSSH Vulnerability Exposes Servers to Root Access for 15 Years

OpenSSH Vulnerability Exposes Servers to Root Access for 15 Years

OpenSSH Vulnerability Exposes Servers to Root Access for 15 Years

Open Source Software Compromised, User Credentials Stolen

Open Source Software Compromised, User Credentials Stolen

An open-source software package with over 1 million monthly downloads was compromised after attackers exploited a vulnerability in the developers' account workflow. This breach allowed access to signing keys and sensitive information. The attackers published a malicious version of the element-data package, which scoured systems for sensitive data such as user profiles, warehouse credentials, cloud provider keys, API tokens, and SSH keys. The malicious version, tagged as 0.23.3, was removed within 12 hours of its release. Developers have since rotated all affected credentials and audited their GitHub actions to prevent future vulnerabilities.

Security Concerns Rise as University Domains Hijacked by Hazy Hawk Group

Security Concerns Rise as University Domains Hijacked by Hazy Hawk Group

A group known as 'Hazy Hawk' has been hijacking unmaintained DNS records of universities and government institutions to serve ad click spam. This attack exploits 'dangling DNS' records, which are CNAME entries pointing to expired domains or non-existent cloud services. By registering these domains, attackers can post content that appears to come from the original institution. At least 30 educational institutions and several government agencies, including the CDC, have been affected. The attack highlights vulnerabilities in DNS management and the potential for misuse of unmaintained records.