opsecsafe — cyber intelligence

2026-03-19

2026-03-19 00:00Z

CRIT

Android devices ship with firmware-level malware

Sophos X-Ops·news.sophos.comin the wild

Sophos and Kaspersky identified Keenadu, a firmware-level backdoor pre-installed on Android devices from budget manufacturers (BLU, Ulefone, DOOGEE, etc.) affecting 500+ devices across 40 countries. The malware injects into libandroid_runtime.so via the Zygote process, achieving persistence across all apps and enabling second-stage payload delivery for ad fraud, credential theft, and data exfiltration. The compromise occurred at the firmware build phase, indicating a supply-chain attack at the OEM level.

SRFOsTACTA0005SRFMobileTACTA0001SRFFirmwareTACTA0007TACTA0003TACTA0011

Edit Score

2026-03-19

2026-03-19 00:00Z

HIGH

Copyright Lures Mask a Multi‑Stage PureLog Stealer Attack on Key Industries

Trend Micro Research·trendmicro.comin the wild

Trend Micro researchers documented a targeted multi-stage PureLog Stealer campaign using localized copyright-violation lures to deliver information-stealing malware to healthcare, government, hospitality, and education sectors across Germany, Canada, the US, and Australia. The attack chain employs encrypted payloads, remote key retrieval, renamed WinRAR for extraction, Python-based loaders, and fileless .NET execution with AMSI bypass and anti-VM evasion. Two operational variants were identified, with the more recent chain using pre-bundled payloads and hardcoded decryption keys, while earlier variants relied on live C&C communication.

SRFApplicationSRFOsTACTA0005TACTA0001TACTA0002TACTA0007SRFWebTACTA0003

Edit Score

2026-03-19

2026-03-19 00:00Z

HIGH

From Invitation to Infection: How SILENTCONNECT Delivers ScreenConnect

Elastic Security Labs·elastic.coin the wild

Elastic Security Labs disclosed SILENTCONNECT, a previously undocumented multi-stage loader actively deployed in-the-wild since March 2025 that delivers ConnectWise ScreenConnect RMM for hands-on keyboard access. The infection chain begins with phishing emails directing users to Cloudflare Turnstile CAPTCHA pages, followed by VBScript execution that downloads and compiles C# code in-memory via PowerShell, ultimately installing ScreenConnect via MSI. The loader employs PEB masquerading, UAC bypass via COM elevation, Windows Defender exclusion, and NT API calls to evade detection while leveraging trusted infrastructure (Google Drive, Cloudflare) for payload hosting.

SRFApplicationTACTA0005TACTA0001SRFNetworkTACTA0011OSWindowsSWScreenconnectVNDConnectwise

Edit Score

2026-03-18

2026-03-18 23:17Z

CRIT

CVE-2025-15031 — Lfprojects Mlflow: A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-15031

A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to improper handling of tar archive entries. Specifically, the use of `tarfile.extractall` without path validation enables crafted tar.gz files containing `..` or absolute paths to escape the intended extraction directory. This issue affects the latest version of MLflow and poses a high/critical risk in scenarios involving multi-tenant environments or ingestion of untrusted artifacts, a CVSSv3.1 9.1 (CRITICAL)

CWECWE 22VNDLfprojectsTYPVulnerability

9.1

CVSS v3.1

Edit Score

2026-03-18

2026-03-18 21:16Z

CRIT

CVE-2026-25873 — OmniGen2: OmniGen2-RL contains an unauthenticated remote code execution vulnerability in the reward server component that

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-25873

OmniGen2-RL contains an unauthenticated remote code execution vulnerability in the reward server component that allows remote attackers to execute arbitrary commands by sending malicious HTTP POST requests. Attackers can exploit insecure pickle deserialization of request bodies to achieve code execution on the host system running the exposed service. CVSSv3.1 9.8 (CRITICAL) · EPSS 61th percentile

CWECWE 502VNDOmnigen2TYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-03-18

2026-03-18 20:17Z

INFO

v3.4.0.48

Mythic releases·github.com

Mythic v3.4.0.48 released with a Dockerfile tag bump to match the release version. This is a routine version bump with no disclosed security fixes, features, or breaking changes in the available metadata.

VNDMythicTYPTool

Edit Score

2026-03-18

2026-03-18 18:16Z

HIGH

CVE-2026-26740 — Giflib_project Giflib: Buffer Overflow vulnerability in giflib v.5.2.2 allows a remote attacker to cause a denial

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-26740

Buffer Overflow vulnerability in giflib v.5.2.2 allows a remote attacker to cause a denial of service via the EGifGCBToExtension overwriting an existing Graphic Control Extension block without validating its allocated size. CVSSv3.1 8.2 (HIGH)

CWECWE 787VNDBufferVNDGiflib ProjectTYPVulnerability

8.2

CVSS v3.1

Edit Score

2026-03-18

2026-03-18 16:16Z

HIGH

CVE-2026-33001 — Jenkins Jenkins: 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-33001

Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running Jenkins. This can be exploited to deploy malicious scripts or plugins on the controller by attackers with Item/Configure permission, or able to control agent processes. CVSSv3.1 8.8 (HIGH)

CWECWE 22CWECWE 59VNDJenkinsTYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-03-18

2026-03-18 16:16Z

HIGH

CVE-2026-24063 — When the bash script is manipulated by an attacker this scenario will lead to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-24063

When a plugin is installed using the Arturia Software Center (MacOS), it also installs an uninstall.sh bash script in a root owned path. This script is written to disk with the file permissions 777, meaning it is writable by any user. When uninstalling a plugin via the Arturia Software Center the Privileged Helper gets instructed to execute this script. When the bash script is manipulated by an attacker this scenario will lead to privilege escalation. CVSSv3.1 8.2 (HIGH) · EPSS 2th percentile

CWECWE 276TYPVulnerability

8.2

CVSS v3.1

Edit Score

2026-03-18

2026-03-18 14:16Z

CRIT

CVE-2026-25449 — Deserialization: of Untrusted Data vulnerability in shinetheme Traveler traveler allows Object Injection.This issue affects

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-25449

Deserialization of Untrusted Data vulnerability in shinetheme Traveler traveler allows Object Injection.This issue affects Traveler: from n/a through < 3.2.8.1. CVSSv3.1 9.8 (CRITICAL)

CWECWE 502TYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-03-18

2026-03-18 11:45Z

HIGH

Introducing Attack Path Management for GitHub in BloodHound Enterprise

SpecterOps·specterops.io

SpecterOps announced BloodHound Enterprise with OpenGraph extensions for GitHub, enabling attack path analysis across GitHub identities, repositories, CI/CD workflows, secrets, and external trust relationships (SSO, OIDC federation to Azure/AWS). The extension models how GitHub acts as both a target and an interchange between systems, exposing paths to critical code, credentials, and cloud pivots that traditional configuration review misses.

SRFApplicationTACTA0006SRFIdentitySRFCloudTACTA0008TACTA0009SRFSupply ChainVNDMicrosoft

Edit Score

2026-03-18

2026-03-18 11:45Z

HIGH

BloodHound Enterprise Expands Beyond Microsoft: Mapping Identity Attack Paths Across Okta, GitHub, and Mac environments

SpecterOps·specterops.io

SpecterOps announced BloodHound Enterprise 9.0 with OpenGraph extensions enabling attack path mapping across Okta, GitHub, and Jamf-managed macOS environments, moving beyond Microsoft-only visibility. The platform now identifies cross-platform privilege chains and introduces Privilege Zones for defining critical security boundaries. The expansion addresses the reality that modern breaches chain privileges across identity providers, developer platforms, and device management systems.

SRFApplicationSRFOsTACTA0004TACTA0001SRFIdentityTACTA0003SRFCloudTACTA0008

Edit Score

2026-03-18

2026-03-18 11:16Z

HIGH

CVE-2026-23246 — Linux: link_removal_timeout[] has IEEE80211_MLD_MAX_NUM_LINKS (15) elements, so index 15 is out-of-bounds.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-23246

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration link_id is taken from the ML Reconfiguration element (control & 0x000f), so it can be 0..15. link_removal_timeout[] has IEEE80211_MLD_MAX_NUM_LINKS (15) elements, so index 15 is out-of-bounds. Skip subelements with link_id >= IEEE80211_MLD_MAX_NUM_LINKS to avoid a stack out-of-bounds write. CVSSv3.1 8.8 (HIGH) · EPSS 6th percentile

TYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-03-18

2026-03-18 11:00Z

HIGH

The SOC Files: Time to “Sapecar”. Unpacking a new Horabot campaign in Mexico

Kaspersky Securelist·securelist.comin the wild

Kaspersky's MDR team dissected an active Horabot campaign targeting 5,384 victims (93% in Mexico) combining fake CAPTCHA lures, polymorphic HTA/VBS loaders, AutoIT-wrapped banking Trojans (Casbaneiro/Ponteiro variants), and email spreader functionality. The attack chain leverages server-side polymorphism, custom XOR-subtraction ciphers for C2 communication, and anti-VM checks, with detailed analysis of encryption routines, socket protocols, and configuration parsing mechanisms.

SRFOsTACTA0001TACTA0002TACTA0006TACTA0007SRFWebTACTA0003TACTA0011

Edit Score

2026-03-18

2026-03-18 10:02Z

CRIT

The Most Organized Threat Actors Use Your ITSM (BMC FootPrints Pre-Auth Remote Code Execution Chains)

watchTowr Labs·labs.watchtowr.comCVE-2025-71257 CVE-2025-71258 CVE-2025-71259 CVE-2025-71260

watchTowr Labs disclosed a pre-authenticated RCE chain against BMC FootPrints ITSM affecting versions 20.20.02–20.24.01.001, comprising four chained vulnerabilities: an authentication bypass via SEC_TOKEN generation in the password-reset endpoint (CVE-2025-71257), two blind SSRFs (CVE-2025-71258, CVE-2025-71259), and Java deserialization RCE via AspNetConfig servlet (CVE-2025-71260). BMC released hotfixes in September 2025 after a lengthy disclosure process; CVEs were assigned March 2026.

SRFApplicationTACTA0001TACTA0002SRFWebTACTA0003VNDBmcTYPResearchTYPWriteup

Edit Score

2026-03-18

2026-03-18 04:17Z

CRIT

CVE-2026-31938 — Parall Jspdf: Prior to version 4.2.1, user control of the `options` argument of the `output` function

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-31938

jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of the `options` argument of the `output` function allows attackers to inject arbitrary HTML (such as scripts) into the browser context the created PDF is opened in. The vulnerability can be exploited in the following scenario: the attacker provides values for the output options, for example via a web interface. These values are then passed unsanitized (automatically or semi-automatically) CVSSv3.1 9.6 (CRITICAL)

CWECWE 79VNDParallTYPVulnerability

9.6

CVSS v3.1

Edit Score

2026-03-18

2026-03-18 04:17Z

HIGH

CVE-2026-31898 — Parall Jspdf: Prior to version 4.2.1, user control of arguments of the `createAnnotation` method allows users

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-31898

jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of arguments of the `createAnnotation` method allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to the following method, a user can inject arbitrary PDF objects, such as JavaScript actions, which might trigger when the PDF is opened or interacted with the `createAnnotation`: `color` parameter. The vulnerability has CVSSv3.1 8.1 (HIGH)

CWECWE 94CWECWE 116VNDParallTYPVulnerability

8.1

CVSS v3.1

Edit Score

2026-03-18

2026-03-18 02:16Z

HIGH

CVE-2026-2603 — Keycloak: A remote attacker could bypass security controls by sending a valid SAML response from

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-2603

A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity Provider is disabled, leading to unauthorized authentication. CVSSv3.1 8.1 (HIGH)

CWECWE 306VNDKeycloakTYPVulnerability

8.1

CVSS v3.1

Edit Score

2026-03-18

2026-03-18 02:16Z

HIGH

CVE-2026-28500 — Linuxfoundation Onnx: In versions up to and including 1.20.1, a security control bypass exists in onnx.hub.load()

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-28500

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. In versions up to and including 1.20.1, a security control bypass exists in onnx.hub.load() due to improper logic in the repository trust verification mechanism. While the function is designed to warn users when loading models from non-official sources, the use of the silent=True parameter completely suppresses all security warnings and confirmation prompts. This vulnerability trans CVSSv3.1 8.6 (HIGH)

CWECWE 345CWECWE 829CWECWE 693CWECWE 494VNDLinuxfoundationTYPVulnerability

8.6

CVSS v3.1

Edit Score

2026-03-18

2026-03-18 00:16Z

CRIT

CVE-2026-27459 — Pyopenssl Pyopenssl: is a Python wrapper around the OpenSSL library.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-27459

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected. CVSSv3.1 9.8 (CRITICAL)

CWECWE 120VNDPyopensslTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-03-18

2026-03-18 00:00Z

HIGH

From Misconfigured Spring Boot Actuator to SharePoint Exfiltration: How Stolen Credentials Bypass MFA

Trend Micro Research·trendmicro.com

Trend Micro documents a SharePoint data exfiltration incident where attackers exploited three chained misconfigurations: exposed Spring Boot Actuator endpoints leaking service account usernames and configuration metadata, plaintext Azure AD application secrets stored in a spreadsheet, and enabled OAuth2 ROPC authentication that bypassed MFA. The attacker used stolen credentials to authenticate via ROPC, obtained a valid access token, and exfiltrated SharePoint data without malware or exploitation.

SRFApplicationTACTA0001TACTA0006TACTA0007SRFIdentitySRFCloudVNDMicrosoftVNDSpring

Edit Score

2026-03-17

2026-03-17 22:16Z

HIGH

CVE-2026-32841 — Edimax Gs-5008pl_firmware: GS-5008PL firmware versions 1.00.54 and prior contain an authentication bypass vulnerability that allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32841

Edimax GS-5008PL firmware versions 1.00.54 and prior contain an authentication bypass vulnerability that allows unauthenticated attackers to access the management interface. Attackers can exploit the global authentication flag mechanism to gain administrative access without credentials after any user authenticates, enabling unauthorized password changes, firmware uploads, and configuration modifications. CVSSv3.1 8.1 (HIGH) · EPSS 19th percentile

CWECWE 1108VNDEdimaxTYPVulnerability

8.1

CVSS v3.1

Edit Score

2026-03-17

2026-03-17 20:16Z

HIGH

CVE-2026-30707 — SpeedExam: It allows Broken Access Control via the ReviewAnswerDetails ASP.NET PageMethod.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-30707

An issue was discovered in SpeedExam Online Examination System (SaaS) after v.FEV2026. It allows Broken Access Control via the ReviewAnswerDetails ASP.NET PageMethod. Authenticated attackers can bypass client-side restrictions and invoke this method directly to retrieve the full answer key. The provider states that this issue is "Fixed in [02/2026] backend service update." CVSSv3.1 8.1 (HIGH) · EPSS 11th percentile

CWECWE 284VNDSpeedexamTYPVulnerability

8.1

CVSS v3.1

Edit Score

2026-03-17

2026-03-17 18:16Z

CRIT

CVE-2026-32298 — Angeet Es3_kvm_firmware: The Angeet ES3 KVM does not properly sanitize user-supplied variables parsed by the 'cfg.lua'

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32298

The Angeet ES3 KVM does not properly sanitize user-supplied variables parsed by the 'cfg.lua' script, allowing an authenticated attacker to execute OS-level commands. CVSSv3.1 9.1 (CRITICAL) · EPSS 18th percentile

CWECWE 78VNDAngeetTYPVulnerability

9.1

CVSS v3.1

Edit Score

2026-03-17

2026-03-17 18:16Z

HIGH

CVE-2026-21570 — Atlassian Bamboo: This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 9.6.0, 10.0.0

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-21570

This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.6, allows an authenticated attacker to execute malicious code on the remote system. Atlassian recommends that Bamboo Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of CVSSv3.1 8.8 (HIGH) · EPSS 41th percentile

CWECWE 94VNDAtlassianVNDHighTYPVulnerability

8.8

CVSS v3.1

Edit Score

Latest intel// live feed

Android devices ship with firmware-level malware

Copyright Lures Mask a Multi‑Stage PureLog Stealer Attack on Key Industries

From Invitation to Infection: How SILENTCONNECT Delivers ScreenConnect

CVE-2025-15031 — Lfprojects Mlflow: A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to

CVE-2026-25873 — OmniGen2: OmniGen2-RL contains an unauthenticated remote code execution vulnerability in the reward server component that

v3.4.0.48

CVE-2026-26740 — Giflib_project Giflib: Buffer Overflow vulnerability in giflib v.5.2.2 allows a remote attacker to cause a denial

CVE-2026-33001 — Jenkins Jenkins: 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links

CVE-2026-24063 — When the bash script is manipulated by an attacker this scenario will lead to

CVE-2026-25449 — Deserialization: of Untrusted Data vulnerability in shinetheme Traveler traveler allows Object Injection.This issue affects

Introducing Attack Path Management for GitHub in BloodHound Enterprise

BloodHound Enterprise Expands Beyond Microsoft: Mapping Identity Attack Paths Across Okta, GitHub, and Mac environments

CVE-2026-23246 — Linux: link_removal_timeout[] has IEEE80211_MLD_MAX_NUM_LINKS (15) elements, so index 15 is out-of-bounds.

The SOC Files: Time to “Sapecar”. Unpacking a new Horabot campaign in Mexico

The Most Organized Threat Actors Use Your ITSM (BMC FootPrints Pre-Auth Remote Code Execution Chains)

CVE-2026-31938 — Parall Jspdf: Prior to version 4.2.1, user control of the `options` argument of the `output` function

CVE-2026-31898 — Parall Jspdf: Prior to version 4.2.1, user control of arguments of the `createAnnotation` method allows users

CVE-2026-2603 — Keycloak: A remote attacker could bypass security controls by sending a valid SAML response from

CVE-2026-28500 — Linuxfoundation Onnx: In versions up to and including 1.20.1, a security control bypass exists in onnx.hub.load()

CVE-2026-27459 — Pyopenssl Pyopenssl: is a Python wrapper around the OpenSSL library.

From Misconfigured Spring Boot Actuator to SharePoint Exfiltration: How Stolen Credentials Bypass MFA

CVE-2026-32841 — Edimax Gs-5008pl_firmware: GS-5008PL firmware versions 1.00.54 and prior contain an authentication bypass vulnerability that allows

CVE-2026-30707 — SpeedExam: It allows Broken Access Control via the ReviewAnswerDetails ASP.NET PageMethod.

CVE-2026-32298 — Angeet Es3_kvm_firmware: The Angeet ES3 KVM does not properly sanitize user-supplied variables parsed by the 'cfg.lua'

CVE-2026-21570 — Atlassian Bamboo: This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 9.6.0, 10.0.0