VulnHub

Researchers have released a working exploit for a serious flaw in AnyDesk's Linux software that allows attackers to execute code remotely and gain root access without any user authentication. This vulnerability was patched in version 8.0.3 in June 2023, but the company described the fix vaguely as a bug that could cause crashes, failing to assign a CVE identifier. Users of AnyDesk on Linux systems are at risk, as the exploit can be executed before a connection is approved. This situation raises concerns about the transparency of security updates and the potential for malicious exploitation if users do not update their software promptly.

Researchers have discovered Linux backdoors that are targeting telecom and network devices in South Korea and Taiwan. These backdoors cleverly disguise their malicious traffic as legitimate email services, making it difficult for security systems to detect them. Attackers often name their malware after real components of the operating system to avoid detection. This tactic not only helps the malware blend in but also poses significant risks to network security in these regions. The ongoing threat underscores the need for enhanced monitoring and detection measures in organizations that rely on Linux systems for critical infrastructure.

A new Linux backdoor named ClingSTUN has been discovered, which exploits 24 known vulnerabilities to take control of Internet of Things (IoT) devices. Once compromised, these devices are turned into proxy nodes that use public STUN servers to hide their communications. This not only allows attackers to mask their activities but also raises significant concerns about the security of IoT devices, which are often less protected than traditional systems. The vulnerabilities exploited are widespread, meaning a large number of devices could potentially be affected. This situation highlights the need for manufacturers and users to prioritize security updates and better protect their IoT infrastructure.

Researchers at Rapid7 have discovered new variants of malware, namely BPFDoor, BPF Rekoobe, and AVERAT, which are specifically targeting telecom and network-edge appliances in South Korea and Taiwan. These sophisticated backdoors are designed to disguise themselves as regular email traffic, making detection more challenging for security systems. The attacks pose a significant risk to telecommunications infrastructure, potentially allowing attackers to gain unauthorized access and control over critical systems. This development raises concerns for companies in the telecom sector, as they must enhance their security measures to counter these stealthy threats. The ongoing targeting of network-edge devices emphasizes the need for vigilance in cybersecurity practices within the industry.

A new backdoor called ClingSTUN has been discovered that exploits the STUN protocol to establish a connection back to attackers. This backdoor not only maintains persistence on infected systems but also includes multiple exploits that allow it to propagate itself to other devices. The presence of ClingSTUN poses a serious risk to Linux systems, as it can potentially compromise sensitive data and disrupt operations. Researchers highlight that this backdoor takes advantage of various vulnerabilities, making it a significant concern for system administrators. Companies using Linux should be vigilant and take immediate steps to secure their systems against this threat.

Researchers have recently identified three backdoors that mimic legitimate Linux security products, specifically those used in mail systems. These malicious implants are designed to go unnoticed, making it challenging for users and security teams to detect them. This poses a significant risk, as attackers can gain unauthorized access to sensitive data and systems while masquerading as trusted solutions. Companies relying on these types of software should remain vigilant and monitor for suspicious activity. The discovery emphasizes the need for robust security measures to protect against such deceptive tactics.

Threat actors have compromised two legitimate MemTensor packages on the npm and PyPI repositories to distribute a malicious program called sckit. This implant targets Windows, Linux, and macOS systems and is designed to steal credentials. Researchers from Aikido, SafeDep, Socket, and StepSecurity have reported on the affected libraries, particularly the @memtensor/memos-cloud-openclaw-plugin versions. This incident raises significant security concerns for developers and users who may have unknowingly installed these compromised packages. It's crucial for affected users to take immediate action to safeguard their systems.

Siemens has identified a vulnerability known as 'Copy Fail' affecting various versions of its SIPLUS and SIMATIC products, specifically linked to CVE-2026-31431. This vulnerability can impact multiple devices, including the SIMATIC HMI series and the AX Runtime Core across different platforms. Siemens is urging users to upgrade to the latest versions of the affected products to mitigate potential risks. For products that do not yet have a fix available, Siemens is providing specific countermeasures. This situation is important as it affects numerous industrial control systems, which could pose operational risks if not addressed promptly.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding the active exploitation of three vulnerabilities in the Linux kernel, with one being classified as critical. These flaws could allow attackers to gain unauthorized access or control over affected systems, posing significant risks to organizations that rely on Linux-based infrastructure. Users and administrators of Linux systems are urged to take immediate action to protect their environments. The vulnerabilities affect various distributions of Linux, and failure to address them could lead to serious security breaches. As these exploits are currently active, it is crucial for those using Linux to stay informed and apply necessary updates promptly.

Security experts have identified three vulnerabilities in the Linux kernel that could be exploited by attackers. These flaws may allow attackers to cause denial-of-service conditions, leak sensitive memory information, or alter memory contents. Organizations using affected versions of the Linux kernel should be particularly vigilant, as the vulnerabilities are actively exploited. It's crucial for system administrators to patch their systems promptly to mitigate these risks. Failure to address these vulnerabilities could lead to serious operational disruptions and data breaches, impacting both individual users and larger organizations.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added several vulnerabilities in the Linux Kernel to its Known Exploited Vulnerabilities catalog. This update indicates that these flaws have been identified as actively exploited in the wild, posing risks to various systems that rely on the Linux operating system. While specific details on the nature of the exploits are not currently available, the inclusion of these vulnerabilities in the catalog signals a need for immediate attention from system administrators and security teams. Users and organizations utilizing affected Linux versions should prioritize patching their systems to mitigate potential attacks, as these vulnerabilities could be leveraged by attackers for unauthorized access or other malicious activities. Staying updated with the latest patches is crucial for maintaining system security.