VulnHub

Researchers have found that Linux eBPF rootkits are gaining traction among cybercriminals, who are utilizing these advanced techniques to conceal malicious activities on systems without needing to load traditional kernel modules. This method allows attackers to evade detection by conventional security measures. The information is being actively shared in underground forums, where hackers are posting source code, tutorials, and exploits specifically targeting Linux environments. This development is concerning for organizations that rely on Linux systems, as the ability to hide harmful actions makes it significantly harder for security teams to identify and respond to intrusions. As these rootkits become more prevalent, companies using Linux must enhance their security protocols to defend against these stealthy threats.

N-able has released hotfixes to address serious zero-day vulnerabilities in its N-central remote monitoring and management (RMM) platform. These vulnerabilities were publicly disclosed over the weekend, prompting the company to take affected hosted environments offline to mitigate potential risks. Users of the N-central platform should apply these hotfixes promptly to secure their systems against possible exploitation. The situation emphasizes the importance of timely updates in the face of emerging security threats, as attackers often seek to exploit newly discovered vulnerabilities. This incident serves as a reminder for organizations using this platform to remain vigilant and proactive in their cybersecurity practices.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has flagged two vulnerabilities in Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder, noting that they are currently being exploited in the wild. The first vulnerability, identified as CVE-2026-20320, has a CVSS score of 7.5 and involves improper restrictions on XML external entities. This means attackers could potentially manipulate XML data to gain unauthorized access or execute malicious commands. Organizations using these products should take immediate action to secure their systems, as the vulnerabilities can lead to significant data breaches or system compromises. Patches are available, but the urgency is heightened due to ongoing exploitation.

The open-source Artex framework, along with 45 other penetration testing tools, has been repurposed by hackers to conduct credential attacks and cloud breaches at unprecedented speeds. This misuse allows attackers to target various industries, raising significant concerns about security among companies that utilize these tools. Researchers have highlighted that the forks of Artex are not just theoretical threats; they are actively being exploited, making it crucial for organizations to be vigilant. As these tools can execute attacks swiftly across different platforms, the risk of widespread breaches increases. Companies using Artex or similar tools should review their security measures to mitigate potential risks.

Last Sunday, an attacker exploited a remote code execution vulnerability in SGLang, an open-source inference engine, to gain unauthorized access to a NEAR AI inference server. This breach allowed the attacker to execute code and potentially view sensitive requests being processed on the server, including those made in a confidential mode designed to enhance privacy through a trusted execution environment. As a result, data from 18 agents and around 100 users was compromised. This incident raises serious concerns about the security of open-source software and the potential risks involved in handling sensitive data. Companies using SGLang or similar technologies need to assess their security measures to prevent future breaches.

A serious security issue has emerged involving Claude Code, an AI coding tool that unintentionally saves files containing sensitive information, such as credentials, to public Git repositories. This oversight poses a significant risk for organizations using the tool, as it could expose their confidential data to anyone accessing these repositories. The incident raises concerns about the security practices surrounding AI tools in software development. Companies using Claude Code need to review their security measures and ensure that sensitive information is not being inadvertently published. This situation serves as a reminder of the vulnerabilities that can arise from integrating AI into coding workflows.

Researchers at Check Point have identified three espionage campaigns linked by shared infrastructure and malware known as Sparrow. These campaigns have primarily targeted telecommunications companies, government bodies, military organizations, research institutions, and critical infrastructure across Latin America, Asia, and Europe over the past year. The clusters, named SilentDelivery, have been using similar malware code, indicating a coordinated effort from a group with ties to China. The implications of these attacks are serious, as they not only threaten sensitive data and national security but also highlight the ongoing risk to critical sectors worldwide. Organizations in these sectors should remain vigilant and enhance their security measures to protect against potential breaches.

Cybersecurity researchers have reported an attack exploiting two vulnerabilities in AhsayCBS, a backup software solution. This attack, observed by Huntress in early October 2026, utilized CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute unauthorized commands on compromised systems. The attackers deployed a Python-based backdoor capable of evading sandbox detection, which raises significant concerns for organizations using AhsayCBS. The vulnerabilities have been patched, but the incident serves as a reminder for companies to regularly update their software and monitor for any signs of compromise. Users of AhsayCBS should ensure they have installed the latest updates to protect against these exploits.

The cybercriminal group known as Blind Eagle has launched a new campaign targeting organizations across Latin America. They are using phishing tactics that mimic court-related notifications, such as court summons and fiscal notices, to trick users into downloading a remote access trojan (RAT). This RAT is linked to known malware variants like AsyncRAT and DCRat. The phishing messages are crafted in Portuguese and Spanish, making them particularly effective against local targets. As organizations fall victim to these tactics, sensitive data could be compromised, highlighting the need for enhanced cybersecurity measures in the region.