VulnHub

The latest Security Affairs newsletter covers a range of cybersecurity issues, including a new macOS backdoor disguised as a fake Zoom installer. This backdoor, known as CloudSyncD, poses a significant risk to macOS users who may unknowingly install this malicious software. Additionally, a critical vulnerability in GitLab's AI Gateway, identified as CVE-2026-90970, has been patched, addressing a serious security flaw that could have been exploited by attackers. The newsletter also highlights the Antino backdoor, which has been linked to various cyberattacks. These incidents emphasize the need for users and organizations to remain vigilant about the software they install and to apply security updates promptly.

A new cybersecurity threat called CloudSyncD is targeting Mac users by using a fake Zoom installer to steal passwords. Once installed, the malware deploys a two-stage backdoor, allowing attackers to gain further control over the infected systems. This tactic not only compromises user credentials but also opens the door for additional malicious activities. Users who think they are downloading a legitimate Zoom app are at risk, making it crucial for them to verify software sources. This incident emphasizes the ongoing need for vigilance against phishing attacks and the importance of downloading applications only from trusted sources.

Security researchers have released a proof-of-concept for a newly identified vulnerability in Apple's CoreGraphics, tracked as CVE-2026-86950. This flaw can be triggered by a malicious PDF containing a specially crafted embedded font, which causes unpatched iPhones and Macs to crash. Apple has indicated that this vulnerability may have been exploited in targeted attacks against specific individuals. Users of iPhones and Macs need to be aware of this risk, especially if they frequently open PDF files from unknown sources. The situation underscores the importance of keeping devices updated to the latest software versions to mitigate such risks.

Apple has released security updates to address a zero-day vulnerability in its CoreGraphics framework that has been exploited in highly targeted attacks on iOS devices. This flaw allows attackers to execute malicious code on affected devices, posing a significant risk to users. The vulnerability specifically impacts various versions of iOS, which means a wide range of Apple device users could be at risk. Users are urged to update their devices as soon as possible to protect against potential exploitation. This incident underscores the ongoing challenges of securing mobile platforms against sophisticated threats.

Apple has issued security updates to fix a vulnerability in older versions of its operating systems, including iOS, iPadOS, and macOS. This vulnerability, identified as CVE-2026-86950, allows for out-of-bounds writes in the CoreGraphics component, which could enable attackers to execute arbitrary code by processing specially crafted files. Apple has indicated that this flaw may have been exploited in targeted attacks, emphasizing the importance of applying these updates promptly. Users of affected devices should ensure their systems are updated to protect against potential exploits. This situation serves as a reminder for all users to regularly check for and install software updates to safeguard their devices.

Threat actors have compromised two legitimate MemTensor packages on the npm and PyPI repositories to distribute a malicious program called sckit. This implant targets Windows, Linux, and macOS systems and is designed to steal credentials. Researchers from Aikido, SafeDep, Socket, and StepSecurity have reported on the affected libraries, particularly the @memtensor/memos-cloud-openclaw-plugin versions. This incident raises significant security concerns for developers and users who may have unknowingly installed these compromised packages. It's crucial for affected users to take immediate action to safeguard their systems.

A North Korean hacking group known as Jade Sleet has been linked to a breach involving a smaller Indian IT services firm. Cybersecurity researchers from SentinelOne reported that the attackers used sophisticated backdoors named FLATROOF and ROOFDECK to infiltrate the organization. The breach underscores the ongoing strategy of targeting smaller developers, which can provide access to larger networks. This incident raises concerns about the security practices of IT service providers, as they often hold sensitive information that could be exploited in further attacks. Companies in the tech sector should reassess their security measures to prevent similar breaches.

A serious vulnerability has been discovered in Docker Sandboxes running on macOS, allowing malicious code to escape its designated project directory. This flaw, tracked as CVE-2026-77179, enables attackers to read and modify files on the host system with the same privileges as the user running the virtual machine. Docker issued a security warning on September 15, highlighting the potential risks for users of affected Docker versions. This vulnerability is particularly concerning because it could lead to unauthorized access to sensitive files, posing a significant threat to data integrity and privacy. Users of Docker on macOS should take immediate action to secure their systems against potential exploitation.

Bransys ELD is facing serious security vulnerabilities that could allow unauthorized access to sensitive telemetry data and firmware. The vulnerabilities, identified as CVE-2026-86520, CVE-2026-86689, and CVE-2026-77960, affect versions of the Bransys ELD app on Android devices older than 11.00.00 and iOS devices older than 1.1.54. The issues include hardcoded credentials for MQTT and FTP, which could enable attackers to read real-time data and access sensitive information transmitted in cleartext. Users are urged to update their apps to the latest versions to protect against these risks, as exploitation could have significant implications for data integrity and privacy, especially in the transportation sector where the system is deployed.

Homebrew, a popular package manager for macOS and Linux, released version 7.0.0 on Sunday, addressing eight security vulnerabilities in the process. The most critical issue involved a flaw that allowed unsigned removal metadata for casks—Homebrew's method for installing prebuilt applications—to execute commands with elevated privileges (sudo). To mitigate this risk, the development team removed the vulnerable recovery code and the related API accessors that could be exploited. This update is particularly important for developers who rely on Homebrew for managing their software installations, as it helps protect their systems from potential abuse. Users are encouraged to update to the latest version to safeguard against these vulnerabilities.

Researchers from the security firm Calif have demonstrated a new worm that can take over WeChat accounts through incoming calls, without the recipient needing to answer or interact with their phone. This attack requires that the caller is already in the victim's WeChat contacts. Calif tested the worm on three different phones, successfully showing how it propagates. The company reported this vulnerability to Tencent, the owner of WeChat, in July 2023. This type of attack raises significant concerns for users, as it exploits a common communication method and could potentially compromise personal information or lead to unauthorized access to accounts.