VulnHub

The latest Security Affairs newsletter covers a range of cybersecurity issues, including a new macOS backdoor disguised as a fake Zoom installer. This backdoor, known as CloudSyncD, poses a significant risk to macOS users who may unknowingly install this malicious software. Additionally, a critical vulnerability in GitLab's AI Gateway, identified as CVE-2026-90970, has been patched, addressing a serious security flaw that could have been exploited by attackers. The newsletter also highlights the Antino backdoor, which has been linked to various cyberattacks. These incidents emphasize the need for users and organizations to remain vigilant about the software they install and to apply security updates promptly.

A new cybersecurity threat called CloudSyncD is targeting Mac users by using a fake Zoom installer to steal passwords. Once installed, the malware deploys a two-stage backdoor, allowing attackers to gain further control over the infected systems. This tactic not only compromises user credentials but also opens the door for additional malicious activities. Users who think they are downloading a legitimate Zoom app are at risk, making it crucial for them to verify software sources. This incident emphasizes the ongoing need for vigilance against phishing attacks and the importance of downloading applications only from trusted sources.

Apple has issued security updates to fix a vulnerability in older versions of its operating systems, including iOS, iPadOS, and macOS. This vulnerability, identified as CVE-2026-86950, allows for out-of-bounds writes in the CoreGraphics component, which could enable attackers to execute arbitrary code by processing specially crafted files. Apple has indicated that this flaw may have been exploited in targeted attacks, emphasizing the importance of applying these updates promptly. Users of affected devices should ensure their systems are updated to protect against potential exploits. This situation serves as a reminder for all users to regularly check for and install software updates to safeguard their devices.

Threat actors have compromised two legitimate MemTensor packages on the npm and PyPI repositories to distribute a malicious program called sckit. This implant targets Windows, Linux, and macOS systems and is designed to steal credentials. Researchers from Aikido, SafeDep, Socket, and StepSecurity have reported on the affected libraries, particularly the @memtensor/memos-cloud-openclaw-plugin versions. This incident raises significant security concerns for developers and users who may have unknowingly installed these compromised packages. It's crucial for affected users to take immediate action to safeguard their systems.

A serious vulnerability has been discovered in Docker Sandboxes running on macOS, allowing malicious code to escape its designated project directory. This flaw, tracked as CVE-2026-77179, enables attackers to read and modify files on the host system with the same privileges as the user running the virtual machine. Docker issued a security warning on September 15, highlighting the potential risks for users of affected Docker versions. This vulnerability is particularly concerning because it could lead to unauthorized access to sensitive files, posing a significant threat to data integrity and privacy. Users of Docker on macOS should take immediate action to secure their systems against potential exploitation.

Homebrew, a popular package manager for macOS and Linux, released version 7.0.0 on Sunday, addressing eight security vulnerabilities in the process. The most critical issue involved a flaw that allowed unsigned removal metadata for casks—Homebrew's method for installing prebuilt applications—to execute commands with elevated privileges (sudo). To mitigate this risk, the development team removed the vulnerable recovery code and the related API accessors that could be exploited. This update is particularly important for developers who rely on Homebrew for managing their software installations, as it helps protect their systems from potential abuse. Users are encouraged to update to the latest version to safeguard against these vulnerabilities.

Google has released a patch for several vulnerabilities in its Chrome browser, including a serious zero-day flaw identified as CVE-2026-85046, which is currently being exploited by attackers. The company confirmed that exploits for this vulnerability are circulating in the wild, prompting the urgent update. Users on Windows, macOS, and Linux should ensure they are running the latest version, which includes Chrome 152.0.7977.82/.83 for Windows and macOS, and Chrome 152.0.7977.82 for Linux. Keeping browsers up to date is crucial to mitigate risks from such vulnerabilities, which could allow attackers to gain unauthorized access or execute malicious code. This incident serves as a reminder of the importance of regular software updates to protect against emerging threats.

The Iranian hacking group known as Nimbus Manticore has been linked to two new types of malware that can affect both Linux and macOS systems. These malware families are remote access trojans (RATs) created using Node.js and JavaScript, allowing attackers to gain control over infected devices. Researchers from Kaspersky noted that the group is using a clever tactic of posing as recruiters to deliver malicious code through fake coding tests. This development is concerning as it expands the group's targeting capabilities and indicates a shift in their methods. Users and organizations using Linux or macOS systems should be vigilant and consider enhancing their security measures to prevent potential infections.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has identified four critical vulnerabilities that are currently being exploited in the wild, adding them to its Known Exploited Vulnerabilities (KEV) catalog. Among these is CVE-2026-65400, a serious authentication flaw in Apple macOS that could allow unauthorized access. Other vulnerabilities affect Microsoft SharePoint, VMware vCenter, and Microsoft IKE, all of which pose significant risks to organizations using these platforms. With a CVSS score of 9.8 for CVE-2026-65400, it’s crucial for users and companies to act quickly to mitigate these risks. The exploitation of these vulnerabilities could lead to severe data breaches or unauthorized access, making it essential for affected parties to stay informed and apply necessary updates and patches.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added several vulnerabilities to its Known Exploited Vulnerabilities catalog, specifically targeting flaws in Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE. One notable vulnerability, CVE-2026-33824, relates to the Windows Internet Key Exchange (IKE) Service Extensions and poses a risk of remote code execution. These vulnerabilities could allow attackers to exploit systems running the affected software, potentially leading to unauthorized access or data breaches. It's crucial for users and organizations utilizing these platforms to take immediate action to mitigate the risks associated with these vulnerabilities. Keeping software updated and applying any available patches is essential to protect against potential exploitation.

The Cybersecurity and Infrastructure Security Agency (CISA) has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating that they are actively being targeted by cybercriminals. The vulnerabilities include a double free flaw in Microsoft Internet Key Exchange (CVE-2026-33824), a weak authentication issue in Microsoft SharePoint (CVE-2026-55040), a path traversal vulnerability in Broadcom's VMware vCenter (CVE-2026-59310), and an improper authentication vulnerability in Apple macOS (CVE-2026-65400). These vulnerabilities pose significant risks, especially for federal agencies, which are required to prioritize their remediation under Binding Operational Directive 26-04. Although this directive specifically targets federal agencies, CISA encourages all organizations to adopt similar practices to enhance their security posture against these threats.

Hackers are exploiting a recently patched vulnerability in macOS, known as CVE-2026-65400, which allows unauthorized access to the macOS Screen Sharing feature. This flaw enables attackers to bypass authentication and gain root access to affected systems, leading to the installation of cryptominers without user consent. The Netherlands’ National Cyber Security Centre has issued a warning about this active exploitation, emphasizing the need for users to update their systems. Apple has released patches for macOS Sequoia (15.7.9), Sonoma (14.8.9), and Tahoe (26.6.1) to address this issue, urging all macOS users to upgrade promptly to protect their devices. Failure to do so could leave systems vulnerable to further attacks and unauthorized resource usage.

Recently, a vulnerability in macOS screen sharing has been exploited by attackers to gain root access to affected systems. Once inside, they deployed a Monero miner, which utilizes the system's resources to mine the cryptocurrency without the owner's consent. This incident raises concerns for macOS users, particularly those who rely on screen sharing features for remote work or support. The exploitation of this vulnerability not only compromises the integrity of the systems involved but also highlights the need for users to stay vigilant about software updates and security practices. As the attacks are ongoing, users should be particularly cautious and monitor their systems for unusual activity.