The Hacker News (43 minutes ago)
An unknown threat actor has been observed targeting unpatched Check Point Security Gateways to obtain initial access via the PHP2Shell vulnerabilities and then a previously reported local privilege escalation flaw in Gaia OS to deploy a backdoor called TSGA.
Read the full story on The Hacker News.
PHP2Shell enabled initial compromise, while CVE-2026-123039 allowed attackers to elevate privileges to root.
Dubbed 4EverAble2Shell, the flaw could allow remote, unauthenticated attackers to execute code with root privileges.
Hasn’t completely ruled out cyberattack as cause of incident that’s damaged Exchange Online and services that rely on it
N-able on Thursday said it’s taking additional precautions in the wake of public disclosure of a new set of flaws tracked as 4EverAble2Shell and Agent2Shell. “We are restricting certain N-central features and integrations,” the company said in a Thursday update.
Also Thursday, the FBI blamed North Korea for a separate social engineering scheme that officials say resulted in the theft of $400 million worth of cryptocurrency.
‘FaceStealer’ scam tied to $400M+ theft, 900+ webcam recordings
A search result isn’t always safe. An access request isn’t always harmless. And a familiar account doesn’t always mean a familiar person is using it. Simple things to remember. Yet a surprising amount of this week’s trouble starts right there.
Public exploit code released earlier this week claims that a local Windows user can gain SYSTEM privileges through the Common Log File System driver. The proof of concept, called SignDrop, targets a log-authentication feature added to the driver last year.
A critical flaw in Red Hat Quay allows an attacker who can access a Quay registry to read and overwrite private container images in every repository. Quay enables anonymous access by default, and while it is enabled, the attacker needs no account.
Citrix has released patches for multiple critical security flaws impacting NetScaler ADC, Citrix NetScaler Gateway, and NetScaler Console that could lead to denial-of-service (DoS) or an authentication bypass.
65 active sources
20 Turkish · 45 English
All sources
