The latest Malware Newsletter from Security Affairs reveals several significant cybersecurity threats. One incident involves a malicious browser extension targeting Twitch users, which has exposed OAuth tokens of around 30,000 individuals to Russian bots. Another report details a campaign called 'Red Heron' that exploits a known vulnerability in Gitea, allowing attackers to deploy a new Linux rootkit. Additionally, researchers discuss a one-click backdoor known as 'Gray Rabbits' that poses risks to systems. These incidents underscore the growing sophistication of malware and the need for users and organizations to remain vigilant against such threats.
A security researcher has made public exploit code for four vulnerabilities in the Linux kernel that allow local users to gain root access, which is the highest level of control on a computer. These vulnerabilities have been patched in recent updates, meaning that systems with the latest kernel versions are not at risk. However, machines running older versions of the kernel could be vulnerable, putting them at potential risk of exploitation. Users and administrators are strongly advised to update their systems to the latest kernel version to prevent unauthorized access. The release of this exploit code increases the urgency for users to ensure their systems are secure, as it makes it easier for attackers to leverage these flaws if they remain unpatched.
The Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. The vulnerabilities, identified as CVE-2025-39964 and CVE-2026-53266, affect the Linux kernel and are categorized as a race condition and an out-of-bounds write, respectively. These types of vulnerabilities are commonly targeted by cybercriminals and pose significant risks to federal agencies. The recent Binding Operational Directive (BOD) 26-04 emphasizes that federal agencies must prioritize quick fixes for these high-risk vulnerabilities. While the directive is aimed at federal agencies, CISA encourages all organizations to adopt similar measures for vulnerability management. Organizations aware of other exploited vulnerabilities can submit them for consideration to be added to the KEV Catalog.
CISA has added a new vulnerability, identified as CVE-2025-39682, to its Known Exploited Vulnerabilities Catalog due to evidence of active exploitation. This vulnerability affects the Linux Kernel and involves improper checks for unusual or exceptional conditions, making it a target for attackers. It poses significant risks particularly to federal agencies, as outlined in the Binding Operational Directive (BOD) 26-04, which mandates that these agencies prioritize rapid remediation of high-risk vulnerabilities. While this directive specifically applies to Federal Civilian Executive Branch agencies, CISA encourages all organizations to adopt similar risk-based vulnerability management practices. Organizations aware of other exploited vulnerabilities that are not listed can submit them for consideration through CISA's nomination form.
ABB has reported a vulnerability in its Ability Edgenius platform, identified as CVE-2026-31431, which affects versions 3.2.0.0 to 3.2.4.1. This flaw in the Linux kernel could allow a locally authenticated user or a compromised container to gain elevated administrative (root) privileges, potentially giving attackers complete control over the affected systems. While there are currently no reports of active exploitation, ABB urges users to apply the security update to version 3.2.4.1 as soon as possible to mitigate the risk. Customers should also limit access to SSH and other remote interfaces to further protect their systems. The vulnerability emphasizes the importance of maintaining updated security measures for edge computing platforms.
Schneider Electric has identified vulnerabilities in its PowerChute Serial Shutdown software, which is used for managing uninterruptible power supplies (UPS) and ensuring proper system shutdowns. The affected versions include PowerChute Serial Shutdown version 1.5 and earlier, as well as version 1.6, which is associated with CVE-2026-13348. This vulnerability allows unauthorized access through excessive authentication attempts, potentially disrupting operations and compromising system data. Users are urged to upgrade to version 1.6, which includes a fix for these issues. Failure to address this vulnerability could leave systems exposed, emphasizing the need for timely updates and adherence to cybersecurity best practices.
Schneider Electric has identified multiple security vulnerabilities in its NetBotz 5 750 and 755 products, which are designed to monitor environmental conditions and security. Specifically, these vulnerabilities could allow attackers to execute arbitrary code or perform SQL injection attacks, potentially leading to unauthorized access and manipulation of the devices. The affected versions are NetBotz 5 750 and 755, both running version 5.5.2 or earlier. Users are strongly encouraged to upgrade to version 5.6.0, which includes fixes for these issues. Failing to apply these updates could pose significant risks, especially for organizations relying on these devices for critical infrastructure monitoring.
Acronis has reported a serious security vulnerability in its Backup plugin for cPanel and Web Host Manager (WHM), which is currently being exploited in targeted attacks. The flaw, known as CVE-2026-87886, has a CVSS score of 7.8 and allows local privilege escalation due to improper file permissions. This issue affects the Acronis Backup plugin for cPanel and WHM on Linux systems. Users of these services should take immediate action, as the vulnerability poses a significant risk to their systems. Promptly addressing this flaw is crucial to prevent unauthorized access and potential data breaches.
A North Korean advanced persistent threat (APT) group has targeted South Korea's media and automotive sectors using a new Linux espionage toolkit. This toolkit allowed the attackers to compromise load balancers, which are critical for managing network traffic, and gain unauthorized access to communications within these organizations. The incident raises significant concerns about the security of sensitive data and communication networks in South Korea, particularly given the geopolitical tensions in the region. The use of an undocumented toolkit indicates that the attackers have advanced capabilities, which could lead to further exploitation of vulnerable systems. Organizations in the affected sectors need to bolster their cybersecurity measures to defend against such sophisticated attacks.
Researchers have identified a new malware family named BambooToken that targets both Windows and Linux systems. This malware uses the MQTT protocol to communicate with compromised devices, making it a versatile threat for cybercriminals. Active since at least February 2023, BambooToken has been used in attacks primarily against organizations in Asia and South America. The use of MQTT allows attackers to maintain control over infected systems effectively, which raises concerns for businesses relying on these platforms. Companies should be vigilant and take necessary precautions to protect their networks from this evolving threat.
Homebrew, a popular package manager for macOS and Linux, released version 7.0.0 on Sunday, addressing eight security vulnerabilities in the process. The most critical issue involved a flaw that allowed unsigned removal metadata for casks—Homebrew's method for installing prebuilt applications—to execute commands with elevated privileges (sudo). To mitigate this risk, the development team removed the vulnerable recovery code and the related API accessors that could be exploited. This update is particularly important for developers who rely on Homebrew for managing their software installations, as it helps protect their systems from potential abuse. Users are encouraged to update to the latest version to safeguard against these vulnerabilities.
Last week, a Linux rootkit was discovered on F5 BIG-IP APM devices, raising significant security concerns for organizations relying on this technology. The rootkit allows attackers to gain unauthorized access and control over affected systems, potentially leading to data breaches or further attacks. Additionally, vulnerabilities in Cisco's FMC (Firepower Management Center) were actively exploited, putting users at risk of unauthorized access and manipulation of security policies. These incidents highlight the need for organizations to ensure their devices are updated and secured against such threats. Companies should prioritize patching and monitoring their systems to mitigate these risks.
Canonical has released Ubuntu 24.04.5 LTS, which includes important security updates and fixes for high-severity vulnerabilities. This update is significant because it is integrated into new installation media, meaning that users who install this version will have these security corrections included right from the start, reducing the number of updates needed post-installation. The release affects not only the standard desktop and server editions of Ubuntu but also nine other flavors such as Kubuntu, Xubuntu, and Ubuntu MATE. This is crucial for users and organizations looking to maintain a secure computing environment, as it helps protect against known vulnerabilities from the outset. Keeping systems updated is essential to defend against potential attacks that could exploit these weaknesses.
Hackers have successfully breached F5 BIG-IP APM devices, deploying a Linux rootkit that can intercept PHP file loading. This rootkit is particularly concerning because it can inject a fileless web shell directly into the device's memory, which means it doesn't leave malicious code on the disk, making detection more challenging. Organizations using F5 BIG-IP APM solutions could be at risk, as the attackers can exploit these vulnerabilities to gain unauthorized access. This situation emphasizes the need for heightened security measures and vigilance among companies that rely on these devices to protect sensitive data. Users should be aware of the potential for exploitation and take immediate action to secure their systems.
A vulnerability in FreeIPA, a system used for managing user identities in Linux domains, allows unauthenticated clients to create their own Kerberos identities. This flaw could enable an attacker to gain access to the administrators group without ever having logged in. The exploit relies on a second vulnerability in the 389 Directory Server, which FreeIPA uses to store identity information. Red Hat has acknowledged the issue, which poses a significant risk to systems that rely on FreeIPA for user management. Organizations using FreeIPA should prioritize addressing this flaw to prevent unauthorized administrative access.