https://ransomfeed.it/news.php Cybersecurity and Ransomware global news en-us https://ransomfeed.it/news.php?id_news=nid&nid=432 248e844336797ec98478f85e7626de4a 432 Tue, 10 Nov 2026 13:02:06 RansomFeed Google ha corretto la vulnerabilità CVE-2026-125350, una vulnerabilità di tipo use-after-free ad alta gravità nel componente XML di Chrome che, secondo Cryptika, viene sfruttata in rete per eseguire codice dannoso da remoto. La correzione è disponibile in Chrome Stable 157.0.8103.50/.51 per Windows e Mac, 157.0.8103.50 per Linux e Extended Stable 156.0.8078.96 per Windows e Mac. Google non ha rivelato gli autori degli attacchi né il numero di obiettivi.
La versione stabile corregge nove vulnerabilità, di cui sette di gravità elevata e due di gravità media, mentre l'aggiornamento stabile esteso ne risolve 11, incluse dieci di gravità elevata. Google sta limitando l'accesso ai dettagli delle vulnerabilità fino a quando la maggior parte degli utenti non avrà ricevuto le correzioni, con possibili restrizioni più lunghe per le librerie condivise interessate. I team di sicurezza dovrebbero dare priorità alla distribuzione su tutte le installazioni di Chrome gestite, verificare le versioni installate e assicurarsi che gli utenti riavviino Chrome per attivare le correzioni, anziché affidarsi esclusivamente al rilascio graduale..

Fonte: https://mallory.ai/stories/01a1c3da-5d49-74a7-b85a-33d227514477]]> https://ransomfeed.it/news.php?id_news=nid&nid=430 f74909ace68e51891440e4da0b65a70c 430 Wed, 28 Oct 2026 16:26:50 RansomFeed CISA added CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, to its Known Exploited Vulnerabilities catalog after confirming exploitation in the wild. The pre-authentication PHP remote code execution flaws carry CVSS v4.0 scores of 9.2. Federal civilian agencies must remediate by October 29 and perform forensic triage; the PHP Foundation has released four patched versions. Cloudflare reported millions of exploitation attempts, while Ox Security found 93.6% of assessed instances remained exposed five days after disclosure, although version-based estimates can miss backported fixes. Praetorian demonstrated exploitation against Apache with mod_php but found reliability highly dependent on configuration, build and memory layout, cautioning against comparisons with uniform, internet-wide Log4Shell exploitation; it had not validated the separate PHP-FPM path.

Dream researchers reported an operation chaining PHP2Shell with the Fragnesia Linux kernel vulnerability to gain root access on 24 perimeter firewalls and an internal management server running an undisclosed vendor’s software. In one US government-affiliated environment, attackers established persistent tunnels, stole credentials and private keys, and enumerated Active Directory. Researchers cited possible Chinese links, while a separate Cyfirma report described scanning by suspected North Korean operators; neither attribution is conclusive. Organizations should prioritize internet-facing PHP services and PHP-based appliance management interfaces, verify vendor-specific exposure and fixes, remove publicly exposed phpinfo pages, and investigate signs of compromise. The NSA advised taking affected systems offline when immediate mitigation is not feasible..

Fonte: https://mallory.ai/stories/01a17f0b-b539-775a-a267-3d232e1d5e73]]> https://ransomfeed.it/news.php?id_news=nid&nid=429 75fc093c0ee742f6dddaa13fff98f104 429 Wed, 28 Oct 2026 16:23:38 RansomFeed Anthropic’s Frontier Red Team reported that an unreleased Claude research model discovered vulnerabilities and assembled five working exploit chains against Chrome, Safari, Android, Windows, and Linux in controlled laboratory tests. Reported results included Chrome sandbox escape, Safari cross-origin data access, data extraction from a physically accessible locked Pixel 9, Windows remote denial of service, and unauthenticated remote root access on Linux under specific conditions. Anthropic said all findings were disclosed to the relevant vendors and patched; no real-world attacks involving these demonstrations were reported.

Apple and Google acknowledgments corroborate specific vulnerability discoveries, but the model’s claimed autonomy and contribution to each exploit chain remain independently unverified. Reporting also identified unresolved discrepancies between Anthropic’s Windows and Linux exploit descriptions and public CVE records, alongside incomplete corroboration of the claimed Chrome CVE total in Google’s release credits. Security teams should prioritize current browser, operating-system, and Linux kernel updates while distinguishing the demonstrated laboratory outcomes from unverified claims about autonomous exploitation..

Fonte: https://mallory.ai/stories/01a181c8-65b6-7463-b8b4-f6c64494db87]]> https://ransomfeed.it/news.php?id_news=nid&nid=431 66368270ffd51418ec58bd793f2d9b1b 431 Wed, 28 Oct 2026 16:21:53 RansomFeed Government spyware makers are abusing global advertising networks to target and compromise devices through malicious online advertisements, according to Citizen Lab. Researchers identified Israeli company Discover-Tech as providing an advertising platform that enables spyware makers to target specific people or devices almost anywhere in the world and deliver spyware capable of covertly stealing data.

Citizen Lab identified Candiru and Bindecy as users of Discover-Tech’s platform and said both companies provide zero-click surveillance products. Victims do not need to click an advertisement, open a message, or follow a link for infection to occur. The reported technique turns online advertising infrastructure into a targeted surveillance delivery channel, underscoring that avoiding suspicious links alone does not address this threat..

Fonte: https://mallory.ai/stories/01a17ed0-aa35-71f8-90f4-13fca672cd50]]> https://ransomfeed.it/news.php?id_news=nid&nid=428 8d7d8ee069cb0cbbf816bbb65d56947e 428 Wed, 28 Oct 2026 16:18:03 RansomFeed The FBI seized virtualine[.]net on October 27 under Operation Omegaline, disrupting Virtualine Technologies, which the Justice Department says also operated as Omegatech. Silent Push had observed infrastructure migrating from Railnet LLC to Omegatech in February 2026; after the seizure, Omegatech remained partially reachable but showed very low routing visibility. The action adds to enforcement and sanctions pressure on bulletproof hosting providers, including THE.Hosting, Media Land and Aeza Group. Silent Push reported that 50 providers it tracks lost their autonomous system numbers (ASNs) over the preceding year, while cautioning that losing an ASN does not necessarily mean an operator has stopped operating.

Related investigations show how hosting networks survive disruption through replacement ASNs, shell companies and infrastructure transfers. Reporting has linked Stark Industries Solutions and MIRhosting to infrastructure supporting pro-Russian DDoS campaigns, proxy services and other malicious activity. ELLIO subsequently traced scanning and exploitation across infrastructure associated with Stark, PQ Hosting and THE.Hosting following EU sanctions. Dutch investigators seized more than 800 servers and arrested two people in May 2026, yet THE.Hosting’s primary network, AS209847, continued scanning through at least May 26. Observed activity included credential attacks, database and industrial-protocol reconnaissance, and Mirai-related payloads; ELLIO cautioned that some scanning likely originated from a separate hosting customer rather than NoName057(16). Defenders should treat domain seizures and ASN losses as disruptions, not proof of shutdown, refresh blocklists frequently, monitor network migrations and allocation changes, screen against both US and EU sanctions lists, and strengthen hosting-customer verification..

Fonte: https://mallory.ai/stories/01a17f0a-fbb9-766d-86ac-0e5c61df5e59]]> https://ransomfeed.it/news.php?id_news=nid&nid=427 18997733ec258a9fcaf239cc55d53363 427 Wed, 28 Oct 2026 16:17:14 RansomFeed Discord plans to make eligible content from Discoverable Servers accessible through Google and other search engines, expanding public exposure beyond its platform. Server Web Pages and discussion summaries are scheduled to launch on November 16, 2026, followed by a gradual rollout of individual messages in mid-December. Older message histories, private servers, direct messages, private threads and forums, and teen accounts are excluded. The change is a planned publishing feature, not a security breach or newly disclosed vulnerability.

Message publication will be enabled by default in most regions. Users can opt out, but the setting protects only subsequently sent messages; previously eligible messages must be deleted to remove them from Discord’s pages, and search-engine copies may require separate removal. Moderators can exclude channels or disable their participation, while Channel Summaries have separate administrative controls. Organizations using public Discord communities should review these controls and remind employees that personal identifiers and workplace information posted in eligible discussions could become searchable outside Discord..

Fonte: https://mallory.ai/stories/01a1807e-92b9-78fb-aba6-b1e3ee12a2de]]> https://ransomfeed.it/news.php?id_news=nid&nid=426 6ecbdd6ec859d284dc13885a37ce8d81 426 Wed, 28 Oct 2026 16:16:07 RansomFeed A phishing campaign is targeting Colombian organizations with Spanish-language fake court notices that deliver the XWorm remote access trojan through malicious VBScript and JavaScript attachments. The obfuscated scripts launch PowerShell to load the RSG_UnityApp .NET loader, which injects XWorm into the legitimate Windows process RegAsm.exe. XWorm collects system information and supports remote command execution, screenshots, file management, plugin loading, and distributed denial-of-service activity over encrypted command-and-control connections.

Arctic Wolf Labs identified infrastructure reuse across multiple builds and loader overlap with a September 2026 UK-linked XWorm case. The same loader also delivered DCRat in another sample, indicating tool reuse but not establishing a common operator or attribution to a named threat actor. Defenders should prioritize detection of script interpreters spawning PowerShell, investigate suspicious RegAsm.exe behavior, and monitor connections to the command-and-control infrastructure identified in the reporting..

Fonte: https://mallory.ai/stories/01a182cb-230f-7ddc-a080-4160427f5923]]> https://ransomfeed.it/news.php?id_news=nid&nid=421 e0c641195b27425bb056ac56f8953d24 421 Tue, 27 Oct 2026 14:37:20 RansomFeed A breach of infrastructure serving Germany’s Alternative für Deutschland (AfD) exposed approximately 300 GB of data, including hundreds of thousands of emails and attachments. The stolen material was published online in October with searchable AI-generated summaries and downloadable original files. Have I Been Pwned recorded approximately 345,000 unique email addresses in the exposed data; that figure does not indicate the number of compromised mailboxes. AfD confirmed an attack on its hosting provider, identified in subsequent reporting as the party-owned Alternita Dienstleistungs GmbH, but said only a few mailboxes had been copied.

An investigation by Lilith Wittmann, conducted with Hoodinformatik and drawing on accounts from the attackers and people associated with the hosting operation, identified an inadequately secured WordPress instance at wahlkampf.afd.de as the initial entry point. Attackers reportedly installed WP-Console to obtain command-line access, accessed mail administration, changed officials’ email passwords, and extracted data through file-hosting services and bulk IMAP requests. The investigation placed detection as early as September 9, followed by another intrusion five days later, while AfD’s statement dated the attack to late September. The party said it notified affected mailbox owners and the data protection officer, contacted security authorities, and reported the attack and publication to law enforcement. It also disputed the accuracy and contextual treatment of the published AI-generated summaries..

Fonte: https://mallory.ai/stories/01a17c72-af3a-7ae7-9fe2-9b86fda8e6ec]]> https://ransomfeed.it/news.php?id_news=nid&nid=420 b6f0479ae87d244975439c6124592772 420 Tue, 27 Oct 2026 14:24:38 RansomFeed CERT-AgID identified multiple phishing campaigns using compromised Italian certified email (PEC) accounts to send fraudulent traffic-fine payment requests impersonating PagoPA. One message demanded €198 by October 27, threatening an increase to €268 after the deadline, and linked to a lookalike payment page hosted under a .ru domain. The fraudulent site requested personal information and payment-card details, exploiting the perceived legitimacy of certified email and public-sector payment services.

The phishing page polled a server-side management panel every half second for instructions to direct victims to additional screens, potentially including prompts for card details and banking verification codes. CERT-AgID contacted the affected PEC providers and reported detecting 1,874 phishing campaigns abusing the PagoPA and SEND names since April 21, 2025. Organizations should treat unexpected payment demands as untrusted even when delivered through PEC, verify fines through official channels, and warn users against entering payment details or verification codes on linked sites..

Fonte: https://mallory.ai/stories/01a17cab-5e22-7c04-9f4d-98e29b54e567]]> https://ransomfeed.it/news.php?id_news=nid&nid=422 f85454e8279be180185cac7d243c5eb3 422 Tue, 27 Oct 2026 13:33:12 RansomFeed Apple released security updates across current and older operating systems, alongside Safari 27.2, with reported fixes for 163 vulnerabilities in iOS and iPadOS 27.2 and 263 in macOS Golden Gate 27.2. Apple’s macOS advisory describes flaws enabling remote arbitrary code execution, root or system privilege escalation, sandbox escapes, Gatekeeper bypasses, and unauthorized access to sensitive user data. Potential attack vectors include malicious web content, files, disk images, network peers, and nearby devices. Fixes address memory safety, authentication, access restrictions, and path validation, among other weaknesses.

Older devices also receive patches through iOS and iPadOS 18.7.11, which reportedly address three vulnerabilities, including one described as a zero-day. The reporting does not establish whether that flaw was actively exploited or provide its CVE identifier; coverage of iOS 27.2 likewise identifies no actively exploited vulnerabilities. Enterprise administrators should prioritize deployment across supported device fleets, including older releases, while consulting Apple’s advisories for applicable fixes. iOS 27.2 also introduces redesigned controls over app access by Siri, Search, and suggestions, an alternative EU App Tracking Transparency prompt, and SynthID labeling for Image Playground images and certain Photos edits..

Fonte: https://mallory.ai/stories/01a17a80-d2b7-79f1-b40f-299f16ed70ee]]> https://ransomfeed.it/news.php?id_news=nid&nid=423 faa9afea49ef2ff029a833cccc778fd0 423 Tue, 27 Oct 2026 13:19:14 RansomFeed Ukraine’s computer emergency response team, CERT-UA, warned that unidentified attackers are compromising Dahua surveillance cameras and video recorders through the Easy4IP cloud remote-access service. Attackers reportedly discover devices by guessing predictable serial numbers, then gain access using weak passwords or authentication-bypass vulnerabilities in outdated firmware, including CVE-2021-33044 and CVE-2021-33045. They modify device settings and create unauthorized accounts. CERT-UA did not disclose the number of affected devices, attack dates or perpetrators.

Unauthorized accounts and recovery codes reportedly survive password changes and, on most firmware versions, factory resets, making those measures alone insufficient to establish that a device is secure. The warning carries particular significance for Ukraine, where Chinese-made cameras remain deployed by government institutions and military units, and Russian intelligence services have previously compromised cameras to monitor air defenses and critical infrastructure. Separately, Hunt.io reported more than 14,500 compromised Dahua devices in August 2026, concentrated in Ukraine and Russia; no formal connection between that activity and CERT-UA’s findings has been established..

Fonte: https://mallory.ai/stories/01a178cf-af2a-7ceb-9c25-8bce8a2398c4]]> https://ransomfeed.it/news.php?id_news=nid&nid=425 25b2822c2f5a3230abfadd476e8b04c9 425 Tue, 27 Oct 2026 13:19:11 RansomFeed The Gheist campaign is using stolen GitHub tokens to plant malicious GitHub Actions workflows and steal repository, organization, and environment secrets. Wiz Research has tracked the activity since September 15, 2026, identifying more than 13,500 planted branches across over 850 compromised accounts. The workflows base32-encode secrets to evade log masking, retrieve execution logs through GitHub’s API, and rapidly delete the runs. GitHub’s approval controls blocked every public-repository run Wiz examined, but successful executions were observed in private repositories and enterprise environments, including GitHub Enterprise Server.

An evolving variant targets self-hosted runners, collecting application tokens, accessing host files through Docker, and harvesting cloud and orchestration credentials. Cloud credentials associated with affected organizations were subsequently used to enumerate AWS Secrets Manager, demonstrating risk beyond source-code repositories. Defenders should revoke compromised GitHub tokens, rotate exposed secrets, and treat affected runner hosts as compromised, while investigating workflow changes and downstream cloud activity. Reported overlaps with malware distribution and cryptomining do not establish common attribution..

Fonte: https://mallory.ai/stories/01a17488-4264-788f-931d-39228dd9c33a]]> https://ransomfeed.it/news.php?id_news=nid&nid=419 7eacb532570ff6858afd2723755ff790 419 Tue, 27 Oct 2026 12:52:48 RansomFeed Japanese IT giant GMO Internet hit by ransomware attack; customer data at risk  KuCoin.

Fonte: https://news.google.com/rss/articles/CBMisAFBVV95cUxOaVF0OU1GVVVnSkh2bGQ4Y1JuWlRWRHE1OHVrM0hXUTR4bHNzZXRPNTR0TjUwZ01DbVBRek9jdzJIWHVGbk9RbkFKZlc0a0VYeEVVQmlxSUdMeU5PM1pVZ29EamFNVXQxYklzSnBlYzdLc2ZDOGpnay1HampRT3NFT3Z5alN0UjBWZFJGU1FEMmlqcEowdHo0cGJCVFdxQ1U0S0U1UldaM05kdzBoZ2E3dA?oc=5]]> https://ransomfeed.it/news.php?id_news=nid&nid=424 3c7781a36bcd6cf08c11a970fbe0e2a6 424 Mon, 26 Oct 2026 23:20:38 RansomFeed Forever Security discovered a malicious AGENTS.md instruction file in a customer's Downloads folder that attempted to persuade an AI coding agent to install the malicious npm package function-color. The real-world attempt was stopped before code executed, and the file's delivery mechanism remains unknown. In isolated tests, however, the planted file caused OpenAI Codex to execute malware in more than 90% of attempts and sought to alter machine-wide configuration for persistence across sessions. Researchers also demonstrated that a web page could silently download an instruction file into Downloads, where a coding agent might later treat it as trusted guidance.

A separate Claude Code proof of concept redirected API traffic to a researcher-controlled server, exposing a session token and allowing malicious responses, with reported success in approximately half of tests. Together, the findings highlight the risk of coding agents treating attacker-controlled local files and configuration as authoritative instructions. Forever recommended avoiding agent sessions in Downloads, inspecting agent instruction files and configuration, retaining approval prompts and sandbox protections, and rotating potentially exposed tokens..

Fonte: https://mallory.ai/stories/01a176dd-80e7-704f-a46d-694e2abb92fb]]> https://ransomfeed.it/news.php?id_news=nid&nid=418 d1f255a373a3cef72e03aa9d980c7eca 418 Fri, 02 Oct 2026 14:31:44 RansomFeed Il 19 settembre il gruppo criminale conosciuto come AuditTeam, specializzato in attacchi ransomware, ha rivendicato una vittima italiana, senza indicarne il nome, come da suo modus operandi classico. Nominandola unicamente “td*up” poi catturata da Ransomfeed, di modo da convincere la vittima ad una trattativa riservata che, come sappiamo, non garantisce che i criminali distruggano i […]
In questo articolo si risale, tramite analisi, alla reale rivendicazione nascosta dietro gli asterischi.

Fonte: https://insicurezzadigitale.com/ransomfeed-auditteam-e-il-caso-della-vittima-italiana-non-definita/]]> https://ransomfeed.it/news.php?id_news=nid&nid=414 66808e327dc79d135ba18e051673d906 414 Thu, 24 Sep 2026 14:23:52 RansomFeed A researcher disclosed a two-stage local privilege-escalation chain affecting OnePlus and OPPO devices running OxygenOS, including the OnePlus 15 on OxygenOS 16.0.3.503 and the OnePlus 12 Pro. A normally installable sideloaded app with no declared permissions can invoke the root-running AtlasService and inject shell commands through the audiodumpinfo debug service, obtaining execution as root in the SELinux dumpstate domain.

The chain then abuses the Oplus Log Core (olc2) vendor HAL's UID-0-restricted doShell method to run commands in the vendorqtiinit_shell SELinux domain, whose bounding set includes all Linux capabilities. OnePlus reportedly confirmed in May that multiple products and software versions are affected, but no complete affected-device list, CVE identifier, remediation details, or evidence of exploitation in the wild had been published..

Fonte: https://mallory.ai/stories/01a0d322-cd08-7ea6-a8fa-f3480b8347ad]]> https://ransomfeed.it/news.php?id_news=nid&nid=412 b9228e0962a78b84f3d5d92f4faa000b 412 Thu, 24 Sep 2026 14:22:53 RansomFeed Prime Minister Andy Burnham announced plans for a National Centre for Information Defence to detect, attribute and disrupt hostile state-led disinformation, principally Russian influence operations. Burnham said Russian agencies are conducting an industrial-scale assault on the UK information environment through bots, fake websites, forged articles, impersonation of British organizations, and attempted election interference, alongside wider hybrid activity such as cyberattacks and sabotage.

The Cabinet Office is developing the centre with intelligence agencies, law enforcement, government departments and social-media companies, but its mandate, powers, structure and launch timetable have not been disclosed. Potential measures could draw on sanctions, domain seizures, law-enforcement action, regulation and offensive cyber capabilities; observers urged clear legal authority, resources and accountability. Burnham also announced a planned US-UK AI-defence partnership to protect critical infrastructure, while critics cautioned that the proposal does not yet address domestic misinformation or algorithmic amplification of harmful legal content..

Fonte: https://mallory.ai/stories/01a0ce6b-6588-7ac3-98c5-6f6dbdbd5532]]> https://ransomfeed.it/news.php?id_news=nid&nid=415 42e7aaa88b48137a16a1acd04ed91125 415 Thu, 24 Sep 2026 14:21:08 RansomFeed The Apache Software Foundation released Apache Tomcat 11.0.26 to remediate 12 vulnerabilities affecting WebSocket, HTTP/2, AJP, authentication handling, and TLS certificate validation. The issues broadly affect Tomcat versions 11.0.0-M1 through 11.0.25 and include four Important-, three Moderate-, and five Low-severity flaws. Reported impacts include WebSocket message smuggling and authorization bypass, HTTP/2 request-header mix-ups, request disruption and denial of service, cross-application authentication-realm reuse, and incomplete certificate-revocation validation.

Apache does not provide individual binary patches and advises organizations to upgrade directly to 11.0.26. Administrators should prioritize internet-facing services using WebSocket, HTTP/2, or AJP; validate deployment artifacts and application compatibility; restart updated instances; and monitor for connection exhaustion, authorization failures, and anomalous cross-request behavior..

Fonte: https://mallory.ai/stories/01a0d1a2-a056-781e-af05-6f823da6e228]]> https://ransomfeed.it/news.php?id_news=nid&nid=413 0deb1c54814305ca9ad266f53bc82511 413 Thu, 24 Sep 2026 14:18:46 RansomFeed A malicious Firefox add-on named PDF Identity Verifier masqueraded as a protected-PDF or identity-verification tool to target signed-in Google users, primarily through Portuguese- and Spanish-language lures. Initially listed in the Firefox Add-ons store, the extension later retrieved its operational configuration and account-takeover scripts from attacker-controlled infrastructure after installation, limiting the malicious code visible during static store review.

The add-on injected remote scripts into legitimate Google sign-in flows, collected session-cookie-related data, account details, and live page telemetry, then exfiltrated them to attacker infrastructure. When Google triggered a password reset, it could silently set and steal a new password, allowing persistent account takeover. Although Socket.dev observed a small user base and no large confirmed victim count, affected users should remove the extension, revoke Google sessions and tokens from a trusted device, reset passwords, and review account-security settings for unauthorized changes..

Fonte: https://mallory.ai/stories/01a0d27d-75e3-7871-9bac-61a9e193006c]]> https://ransomfeed.it/news.php?id_news=nid&nid=417 41ae36ecb9b3eee609d05b90c14222fb 417 Thu, 24 Sep 2026 12:41:15 RansomFeed .

Fonte: https://news.google.com/rss/articles/CBMiX0FVX3lxTE1LU0k5bUZHd0NkaU8zTjVST1JvZEZ0Mnk0d2ZmM1JqR2VxTGVDNE81Q2ZqNElWQzJlWVliYXZwd0w1SzlaNm0zb3VJUjJCTzUtMVp5UVR0cDlzV0R0eXY00gFkQVVfeXFMTzdzakdYU2pOdF9DczlVX1VoOTc3clhlWXNTOFQ5aGRTVXZlemJUWmdiOEdUeDBrMWVGYmI5ajFWX3ZqSGo3Rk8tbmtCZ3hkNm5MS3FmYnBvWl9RRlIxRGUxSFBVUg?oc=5]]> https://ransomfeed.it/news.php?id_news=nid&nid=411 17d63b1625c816c22647a73e1482372b 411 Thu, 24 Sep 2026 12:04:51 RansomFeed .

Fonte: https://news.google.com/rss/articles/CBMiaEFVX3lxTE5OOXNua2FHbUxydXZCRnVLUlJMdUlnM3NKOUVPOGRnejkyWVQ1SGM2Nk4yOW9kVDRmcUd3NVdlQTdtMzJMeDZrUFp5cmhlMU9aTVpRcDRFTDd5bEh2UGo5cjBmZjdCYUlN0gFoQVVfeXFMTk45c25rYUdtTHJ1dkJGdUtSUkx1SWczc0o5RU84ZGd6OTJZVDVIYzY2TjI5b2RUNGZxR3c1V2VBN20zMkx4NmtQWnlyaGUxT1pNWlFwNEVMN3lsSHZQajlyMGZmN0JhSU0?oc=5]]> https://ransomfeed.it/news.php?id_news=nid&nid=416 8fe0093bb30d6f8c31474bd0764e6ac0 416 Thu, 24 Sep 2026 08:12:07 RansomFeed Canonical is replacing Ubuntu's separate four-week Stable Release Update and two-week security-update schedules with overlapping two-week kernel release cycles, delivering a new kernel release each week. Each cycle spends its first week on package preparation, builds, smoke testing, and publication to the -proposed archive; certification, integration, and regression testing occur during the second week before general availability.

The change responds to a growing volume of Linux kernel CVEs, including vulnerabilities identified through AI-assisted bug discovery and expanded upstream CVE assignment. Organizations that need patches sooner can deploy weekly -proposed release candidates, but must accept that Canonical certification is incomplete and assume more regression-testing responsibility. Canonical also plans to publish safe workarounds within 24–48 hours of public disclosure when fixes are unavailable, or provide hardening guidance where no workaround exists..

Fonte: https://mallory.ai/stories/01a0cf0f-aab8-7250-a22a-aa64a0a7e6ca]]> https://ransomfeed.it/news.php?id_news=nid&nid=406 8cb22bdd0b7ba1ab13d742e22eed8da2 406 Wed, 23 Sep 2026 10:13:41 RansomFeed A new DarkMe remote-access Trojan campaign has shifted from the exploit-led delivery associated with Water Hydra to straightforward phishing. Lures disguised as image links served executable .PIF files, which launched a remote MSI installer and a multistage Visual Basic 6 loader chain. The chain registers a COM object and invokes it through rundll32.exe /sta {CLSID}, checks for sandbox-like processes, creates persistence through a custom Locked:// URI handler, and process-hollows the signed Microsoft clspack.exe binary.

The final payload combines remote-access and infostealing functions: it can collect cryptocurrency-wallet data, take screenshots, enumerate installed antivirus products, manipulate files, and run commands. It communicates over custom TCP command-and-control on port 7712; observed infrastructure included thatawful[.]boutique resolving to 67.43.50[.]11:7712. Organizations should block the identified infrastructure, investigate .PIF downloads and suspicious remote MSI execution, and hunt for the rundll32.exe /sta COM-launch pattern and unauthorized Locked:// registry protocol handlers..

Fonte: https://mallory.ai/stories/01a0cd53-1e0c-7b0c-b5de-b987c058dc3c]]> https://ransomfeed.it/news.php?id_news=nid&nid=408 0d0fd7c6e093f7b804fa0150b875b868 408 Wed, 23 Sep 2026 10:09:18 RansomFeed WordPress released version 7.1.2 to fix critical vulnerability CVE-2026-87902 / GHSA-7hp8-65ch-5whp, an improper filename-validation flaw (CWE-98) in getpagetemplate(). Under specific server and active-theme conditions, an unauthenticated attacker can influence page-template resolution to include a readable local PHP file outside the active theme directory, potentially resulting in remote code execution.

Exploitation requires the top-level directory for the selected template to begin with page-, a condition reported in the Twenty Twelve and Twenty Fourteen themes as well as some third-party themes. The flaw carries a CVSS score of 9.2; administrators should update immediately to 7.1.2 or ensure automatic updates are enabled. Fixes are also being backported to security-supported WordPress releases from version 4.7 onward..

Fonte: https://mallory.ai/stories/01a0c9b1-7666-7ecb-af19-bc04f03a6fbf]]> https://ransomfeed.it/news.php?id_news=nid&nid=407 f4f6dce2f3a0f9dada0c2b5b66452017 407 Wed, 23 Sep 2026 10:09:08 RansomFeed ShinyHunters claims it exploited an alleged pre-authentication Oracle PeopleSoft zero-day for remote code execution against an FBI jobs webpage, defaced the site, and pivoted into FBI-managed AWS GovCloud infrastructure. The group says it exfiltrated roughly 2–3 TB of data involving current, former, and prospective FBI personnel, as well as agents’ spouses; reported sample records include names, home addresses, and phone numbers, some of which were reportedly verified against public records.

The group says the intrusion was not financially motivated and demands that the FBI retract or correct allegations in a May 15 bulletin linking ShinyHunters to harassment, threatening communications, and swatting. The claims, including the alleged PeopleSoft vulnerability, lateral movement, and data theft, remain unverified: the FBI, Oracle, and AWS had not publicly confirmed the incident. If authentic, the exposure could enable targeted harassment, coercion, extortion, or counterintelligence targeting of FBI personnel and their families..

Fonte: https://mallory.ai/stories/01a0ca52-c7dd-7b7e-97b4-b7216bc8fbf1]]> https://ransomfeed.it/news.php?id_news=nid&nid=409 a96b65a721e561e1e3de768ac819ffbb 409 Wed, 23 Sep 2026 07:14:33 RansomFeed .

Fonte: https://news.google.com/rss/articles/CBMiswFBVV95cUxPMUFmUkVJQnFzT2I3aXduLVFFMUJVQ3lSVEtXR3dfbzFQQnZObFZuZXdnbHlDcTJ3eGx0cFA5UUVGTUl0aV9haVN6a2N6WnE4bnlTN0ZUc1hiV3RfMG5qZ2xuanhsM2tjRnpFcTZZZ29PSFFxNjZyUjl5R3FQN3lUSWxWNEladE9qaEt6QWFGSVhZU2VPZUgtS2F0S1BvWUFSTUh5NjFXWDNUZXhrTlVITnNnbw?oc=5]]> https://ransomfeed.it/news.php?id_news=nid&nid=410 1068c6e4c8051cfd4e9ea8072e3189e2 410 Wed, 23 Sep 2026 07:00:00 RansomFeed .

Fonte: https://news.google.com/rss/articles/CBMiY0FVX3lxTE9OWUtlVkxVajhmOUJma1dCV1N6X0RZNnF5b1ZOSVJDSmtwLXNqYkxhaDNucWdGTXdUQUFGeEl0ZWx2Qm9yak1tWHRsY0NjbFBMdWFaM3cwUUZoMzZWQVduMUpwMA?oc=5]]> https://ransomfeed.it/news.php?id_news=nid&nid=405 bbcbff5c1f1ded46c25d28119a85c6c2 405 Sun, 23 Aug 2026 10:41:01 RansomFeed Spaggiari Hacked, xpl0itrs Claims 6.1 TB From 3,000+ Italian Schools. Is ClasseViva Safe?  Pasquale Pillitteri.

Fonte: https://news.google.com/rss/articles/CBMijwFBVV95cUxOWVcwdnF1UUFsV1dYUnhKWVZDSlBpU3hkc3pSdTZqcWVnN0VnTUtnX01UQzh0Qm1JajF4STl6TzR4azlKTGNSWWVaREVpTC0zLV9ZLTFjRmZMSWNrYnJsNkREdFBIZGR2UXJJUHVpcnpzTjRmY3lsb0V4VVlWdWUtUjVBRkozdzhDOW5fRVlGaw?oc=5]]> https://ransomfeed.it/news.php?id_news=nid&nid=404 4f4adcbf8c6f66dcfc8a3282ac2bf10a 404 Sun, 23 Aug 2026 10:13:00 RansomFeed Japan outlines measures to protect infrastructure from cyberattacks  The Japan Times.

Fonte: https://news.google.com/rss/articles/CBMiqgFBVV95cUxQbEJEQ29kb2JycjZJdUNqTUFDTy1zbmdRM0VxSnozeGNDTllnMFRjd0lqZGdjWkhTUjdjM2tEdmtQT1dRQU5Pc3hZaWpQaEdCbndyTVZjSEZyU0NFQ2tfQlEwTGpKczBNZGpfY1hFblZWM2ZVcjhmOEF4bE10NUpVbzRQYTk5UURycXBNSW9mc3JmMzBEaE1FSlNMYnU3MWJFckZlbGtNUlZpQQ?oc=5]]> https://ransomfeed.it/news.php?id_news=nid&nid=402 69cb3ea317a32c4e6143e665fdb20b14 402 Mon, 13 Jul 2026 15:09:31 RansomFeed Researchers identified a Windows DLL backdoor dubbed SolidPDFCreator and attributed it to the China-linked threat group Mustang Panda, describing the malware as a stage-1 backdoor used in a campaign targeting entities in India. The sample was tied to "Target India – Campaign 3" and documented as an early-access implant intended to establish an initial foothold on compromised systems.

Available reporting describes the malware as a DLL-based payload and provides core triage details including file type, size, hashes, compiler characteristics, and binary section information. The publication of these indicators gives defenders material to hunt for related activity and assess whether Mustang Panda infrastructure or tooling associated with SolidPDFCreator is present in their Windows environments..

Fonte: https://mallory.ai/stories/019f5b97-b731-757f-9232-4d37594e27e2]]>