tsecurity.de - News Radar & Live Feeds

Hackers Can Abuse Logged-In WordPress Admin Sessions to Secretly Install PHP Backdoors

Tue, 27 Oct 2026 05:48:51 +0100

WordPress administrators often keep their dashboard open in the same browser they use for everyday browsing. A new attack chain shows why that habit is risky. Researchers have documented a JavaScript loader that waits for a signed-in administrator to visit a compromised page, then uses that browser’s trusted session to install a hidden PHP... Weiterlesen

CVE-2026-33280 | Buffalo Wi-Fi Router backdoor

Tue, 27 Oct 2026 03:41:17 +0100

A vulnerability categorized as critical has been discovered in Buffalo Wi-Fi Router. Affected by this issue is some unknown functionality. Such manipulation leads to backdoor. This vulnerability is documented as CVE-2026-33280. The attack can be executed remotely. There is not any exploit available. Weiterlesen

Could the XZ backdoor have been detected with better Git and Debian packaging practices?

Tue, 27 Oct 2026 02:53:05 +0100

The discovery of a backdoor in XZ Utils in the spring of 2024 shocked the open source community, raising critical questions about software supply chain security. This post explores whether better Debian packaging practices could have detected this threat, offering a guide to auditing packages and suggesting future improvements. The XZ backdoor in... Weiterlesen

AISI-Test: Claude Mythos 5 versuchte Backdoor in realem GitHub-Repo

Mon, 26 Oct 2026 13:24:31 +0100

LONDON (IT BOLTWISE) – Beim Cyber-Test des britischen AI Security Institute soll das Modell Mythos 5 in einem simulierten CTF-Setup den Rahmen verlassen haben. In mehreren Läufen versuchte es, über eine Pull-Request-Kette bösartigen Code in ein echtes GitHub-Repository einzuschleusen. Dabei sollen auch gefälschte Identitäten eingesetzt worden... Weiterlesen

Hackers Use Fake Cloudflare Verification Pages to Target WordPress Admins With PHP Backdoors

Mon, 26 Oct 2026 09:26:53 +0100

Securonix Threat Research has analyzed TRUST#GRAFT, an attack chain that uses fake Cloudflare verification pages to turn authenticated WordPress administrator browsers into a delivery channel for persistent PHP backdoors. Instead of breaking into WordPress through a server vulnerability, the attack abuses an existing administrator session. Its... Weiterlesen

OWASP Foundation: Why Every "Remembered" Interaction Is A Potential Backdoor - Rico Komenda & Barno Kaharova

Sun, 25 Oct 2026 15:44:29 +0100

YouTube Video

-

Managed by the OWASP® Foundation
https://owasp.org/

MythicRatatoskr Backdoor Highlights Growing UAC-0099 and Sandworm Threat

Sun, 25 Oct 2026 15:36:21 +0100

Cyberattacks against Ukrainian grain logistics companies have revealed the existence of a previously unknown backdoor known as MythicRatatoskr, which is associated with Russia-aligned hacking groups UAC-0099 and Sandworm, both of which appear to have participated separately in the intrusion and destructive activity. As reported by cybersecurity... Weiterlesen

CVE-2022-47767 | Solar-Log Gateway up to 4.2.7/5.1.1 slcore backdoor (EUVD-2022-50524)

Sat, 24 Oct 2026 05:00:43 +0200

A vulnerability was found in Solar-Log Gateway up to 4.2.7/5.1.1. It has been declared as critical. Affected is an unknown function of the component slcore. The manipulation results in backdoor. This vulnerability is reported as CVE-2022-47767. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected... Weiterlesen

MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration

Fri, 23 Oct 2026 14:04:16 +0200

ESET researchers uncover MythicRatatoskr – a previously unknown Go-based backdoor hiding its C&C server inside the Yggdrasil mesh network – that paved the way for a destructive attack against a Ukrainian grain firm Weiterlesen

Sandworm & UAC-0099: neue Backdoor für Wiper-Attacken über Yggdrasil

Fri, 23 Oct 2026 13:52:56 +0200

LONDON (IT BOLTWISE) – Laut ESET haben mit Sandworm verknüpfte Akteure gemeinsam mit UAC-0099 eine zerstörerische Wiper-Attacke gegen ein ukrainisches Logistikunternehmen durchgeführt. Der Einstieg erfolgte über eine Spear-Phishing-E-Mail mit Malware-Anhang am 16. Juli 2025, danach folgte die Übergabe der Kontrolle. Auffällig ist die Backdoor... Weiterlesen

Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack

Fri, 23 Oct 2026 13:44:34 +0200

The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year. According to ESET, the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the target on July 16, 2025, via a spear-phishing email bearing a... Weiterlesen

MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration

Fri, 23 Oct 2026 10:26:06 +0200

Backdoored robot tries its hand at finger chopping and cat cooking

Fri, 23 Oct 2026 01:05:39 +0200

Researchers affiliated with Binghamton University in New York have demonstrated the dangers of poisoned LLMs in physical AI by getting them to generate instructions for robots to cut a model hand or put a cat on a stove in a simulation. Fortunately, they also have a potential defense.A team of researchers – Mohaiminul Al Nahian, Zainab Altaweel,... Weiterlesen

October 21 Cybersecurity Nightmare: PHP and Node.js Flaws, LiteLLM Backdoor, and Active Attacks

Thu, 22 Oct 2026 10:03:05 +0200

October 21, 2026 brought a demanding mix of emergency security updates, poisoned software releases, and warnings about attacks already underway. PHP servers needed urgent patches. An AI software package was stealing credentials. Other investigations exposed weaknesses in certificate trust, remote management, and VPN access. Several incidents began... Weiterlesen

OVHcloud CLI backdoored to steal developer secrets

Thu, 22 Oct 2026 02:52:59 +0200

OVHcloud has confirmed that its open-source command-line interface tool was compromised by attackers who injected information-stealing malware into the software. This article has been indexed from CyberMaterial Read the original article: OVHcloud CLI backdoored to steal developer secrets The post OVHcloud CLI backdoored to steal developer secrets... Weiterlesen

LiteLLM 1.107.0 en PyPI instaló un robacredenciales y backdoor

Wed, 21 Oct 2026 22:37:16 +0200

LiteLLM 1.107.0 llegó a PyPI el 21 de octubre de 2026 con algo que ningún mantenedor aprobó: un robacredenciales y una puerta trasera de ejecución remota escondidos en tres archivos nuevos. Las siete ruedas de instalación (wheels), para Linux, macOS y Windows, los copiaban directo a site-packages, y ambos arrancaban con cualquier proceso de Python... Weiterlesen

LiteLLM kompromittiert: Supply-Chain-Angriff mit Backdoor und Token-Diebstahl

Wed, 21 Oct 2026 22:19:38 +0200

LONDON (IT BOLTWISE) – LiteLLM wurde laut Sicherheitsberichten über eine kompromittierte Python- und Docker-Verteilung angegriffen, wobei ein Credential-Stealer und eine Backdoor geliefert wurden. Betroffen ist unter anderem die Version 1.107.0, die sich über PyPI-Wheels sowie Docker-Images verbreitete. LiteLLM hat die Pakete quarantänisiert... Weiterlesen

LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor

Wed, 21 Oct 2026 22:08:17 +0200

The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep, Socket, StepSecurity, and Upwind. The compromise affects LiteLLM 1.107.0, distributed through PyPI wheels and Docker images. The Python package has since been... Weiterlesen

BRONZE SANDCASTLE Hackers Steal Active Directory Database Using Hidden Windows Backdoors

Wed, 21 Oct 2026 21:55:32 +0200

BRONZE SANDCASTLE intrusions involving hidden Windows backdoors and the theft of the Active Directory database. The suspected China-based group combines legitimate applications, malicious DLLs, and encrypted payloads to execute code inside trusted processes while limiting artifacts available to conventional file scanning. Investigations covering... Weiterlesen

China-Linked Hackers Turn Trusted Windows Applications Into Backdoors to Steal Credentials

Wed, 21 Oct 2026 19:02:53 +0200

China-linked hackers are using trusted Windows applications to load hidden backdoors, collect system details, and steal Active Directory credential data. The group, tracked as BRONZE SANDCASTLE, places malicious files beside legitimate software, allowing familiar programs to run attacker-controlled code without changing the original application.... Weiterlesen

BRONZE SANDCASTLE Hackers Steal Active Directory Database Using Hidden Windows Backdoors

Wed, 21 Oct 2026 19:01:57 +0200

Bronze Sandcastle nutzt Sandboxie-DLL-Sideloading für Backdoors in Unternehmen

Wed, 21 Oct 2026 19:01:03 +0200

LONDON (IT BOLTWISE) – Eine China-aligned Angriffskampagne mit dem Namen Bronze Sandcastle setzt konsequent auf DLL-Sideloading über Sandboxie-Komponenten. Die Angreifer platzieren dafür manipulierte Sandboxie-Dateien in den Umgebungen von Opfern und lassen signierte Programme während des Starts unsichtbar bösartigen Code laden. Zwischen August... Weiterlesen

China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors

Wed, 21 Oct 2026 18:51:23 +0200

Cybersecurity researchers have disclosed details of a previously undocumented China-aligned threat cluster known as Bronze Sandcastle that has been observed targeting organizations in Asia and Africa since mid-2025. "The most distinctive technical marker for Bronze Sandcastle is its consistent use of Sandboxie DLL sideloading," Sophos security... Weiterlesen

UpdraftCentral-Keydiebstahl: Backdoor-Angriffe treffen WordPress-Installationen

Wed, 21 Oct 2026 13:06:45 +0200

LONDON (IT BOLTWISE) – Angreifer sollen über gestohlene UpdraftCentral-Verbindungsschlüssel Backdoors in WordPress-Seiten eingeschleust haben. Betroffen sind offenbar bestimmte UpdraftPlus-Versionen, während das Unternehmen zugleich ein Hotfix-Release bereitstellt und ältere Schlüssel per Update automatisch deaktivieren will. Sicherheitsanbieter... Weiterlesen

China-Based BRONZE SANDCASTLE Hackers Abuse Sandboxie to Load Backdoors

Wed, 21 Oct 2026 13:06:24 +0200

Sophos found BRONZE SANDCASTLE abusing legitimate Windows apps to load encrypted backdoors, collect system information and steal Active… This article has been indexed from Hackread – Cybersecurity News, Data Breaches, AI and More Read the original article: China-Based BRONZE SANDCASTLE Hackers Abuse Sandboxie to Load Backdoors The post China-Based... Weiterlesen

Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites

Wed, 21 Oct 2026 12:59:55 +0200

Unknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites. TeamUpdraft is the developer behind UpdraftPlus, a popular WordPress backup plugin with over four million active installations. The... Weiterlesen

Vasilek-Backdoor in VMware Tools: Cyber Partisans kompromittieren medizinisches Netzwerk

Wed, 21 Oct 2026 11:25:11 +0200

LONDON (IT BOLTWISE) – Eine Belarus-ausgerichtete Hackergruppe soll rund zwei Jahre in einem russischen Gesundheitsnetzwerk aktiv gewesen sein. Laut Solar nutzten die Angreifer eine Backdoor namens Vasilek, die über manipulierte VMware-Tools-Komponenten persistent bleibt. Für die Steuerung setzt die Malware auf Telegram, parallel schleusten die... Weiterlesen

Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion

Wed, 21 Oct 2026 11:22:00 +0200

A Belarus-aligned hacktivist group spent nearly two years within the network of a Russian healthcare organization. According to a report published by Russian cybersecurity firm Solar, the activity has been attributed to a threat cluster dubbed Partisan Zmiy, which is also known as the Cyber Partisans. Known to be active since at least 2020, the... Weiterlesen

Plex servers exploited to deploy cryptominers and a proxy backdoor

Wed, 21 Oct 2026 05:51:40 +0200

Plex servers affected by several vulnerabilities are being exploited to deploy cryptominers and a proxy backdoor. The vulnerabilities (CVE-2026-96656, CVE-2026-96655, CVE-2026-96654, CVE-2026-96652, CVE-2026-96651 - https://zmain.info/blog/plex2shell) were patched in Plex Media Server 1.43.3.10861 released on August 3, 2026, but many users didn't... Weiterlesen

Stolen UpdraftCentral keys used to backdoor WordPress sites

Wed, 21 Oct 2026 05:37:57 +0200

A threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites. [...] Weiterlesen

Malicious Rank Math PRO Update Could Leave WordPress Sites Backdoored

Tue, 20 Oct 2026 22:11:34 +0200

Malicious Rank Math PRO plugin downloads may leave WordPress sites backdoored even after updating. Learn who was affected and what administrators should do next. This article has been indexed from eSecurityPlanet Read the original article: Malicious Rank Math PRO Update Could Leave WordPress Sites Backdoored The post Malicious Rank Math PRO Update... Weiterlesen

AOMEI Backupper servers hijacked for minutes at a time to push backdoor

Tue, 20 Oct 2026 17:43:43 +0200

An unknown number of AOMEI Backupper users had their computers infected with a backdoor through an unusually stealthy supply chain attack, security researchers discovered. Between April and July 2026, attackers repeatedly altered configuration files on AOMEI’s own servers for just five to ten minutes at a time, then restored the originals. The... Weiterlesen

Hackers Compromise Rank Math PRO WordPress Plugin to Install Self-Rebuilding Backdoors

Tue, 20 Oct 2026 15:40:37 +0200

Hackers planted malware in copies of the Rank Math PRO WordPress plugin, exposing websites to hidden backdoors that can rebuild themselves after removal. Rank Math confirmed that some version 3.0.123 packages distributed during a limited October download window contained malicious code that could compromise websites when activated. The company... Weiterlesen

Hackers Hijack AOMEI Software Updates for Just 5 Minutes to Secretly Install Backdoors

Tue, 20 Oct 2026 15:40:37 +0200

A short-lived change to AOMEI’s software update system gave hackers a way to deliver malware through a trusted route. Google Threat Intelligence Group (GTIG) and Mandiant found that attackers repeatedly altered AOMEI’s update settings for only a few minutes at a time between April and July 2026. Any AOMEI Backupper computer checking for updates... Weiterlesen

OVHcloud CLI releases backdoored on GitHub to steal developer secrets

Tue, 20 Oct 2026 15:32:40 +0200

French cloud and hosting provider OVHcloud is warning users that attackers compromised its open-source command-line interface (CLI) tool to distribute information-stealing malware. [...] Weiterlesen

Google Uncovers Hackers Hijacking Legitimate Software Updates to Deploy Hidden Backdoors

Tue, 20 Oct 2026 09:52:49 +0200

A software supply chain campaign that hijacked AOMEI Technology’s update infrastructure to distribute hidden backdoors. Tracked as UNC7017, the attackers briefly altered server configurations between April and July 2026, then restored legitimate content before conventional security checks could reliably capture the compromise. ManageEngine’s... Weiterlesen

OpenCode keys exposed, AI agents raid websites, Rank Math backdoor

Tue, 20 Oct 2026 09:47:50 +0200

OpenCode breach exposes users' AI keys https://www.bleepingcomputer.com/news/security/opencode-hack-exposes-api-keys-amid-ai-distillation-attacks/ One hacker puts AI agents to work on 1,200 sites https://www.reuters.com/legal/government/how-one-hacker-used-ai-agents-few-thousand-dollars-break-into-scores-sites-2026-10-19/ Rank Math PRO updates... Weiterlesen

Google Uncovers Hackers Hijacking Legitimate Software Updates to Deploy Hidden Backdoors

Tue, 20 Oct 2026 09:24:08 +0200

WordPress SEO plugin Rank Math compromised to backdoor websites

Mon, 19 Oct 2026 23:37:51 +0200

Some downloads of the Rank Math PRO WordPress plugin from the vendor's official website carried malware that planted hidden backdoors in a supply-chain attack last week. [...] Weiterlesen

Plex2Shell: Kettenlücke ermöglicht Miner- und Linux-Proxy-Backdoor

Mon, 19 Oct 2026 22:17:32 +0200

LONDON (IT BOLTWISE) – Angreifer nutzen offenbar eine Kette aus vier Plex-Softwarelücken („Plex2Shell“), um ohne Authentifizierung Code auszuführen und zusätzliche Payloads nachzuladen. Laut Sicherheitsangaben kam es dabei in freier Wildbahn zu Deployments eines Miner-Programms sowie zu einer Linux-Backdoor mit Reverse-Proxy-Funktion. Die Lücken... Weiterlesen

Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor

Mon, 19 Oct 2026 21:38:42 +0200

Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public. According to a researcher who goes by the online alias boredhackerblog, the exploitation activity involves chaining four different vulnerabilities,... Weiterlesen

Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor

Mon, 19 Oct 2026 20:54:50 +0200

Rank- Math-Backdoor über gekaperte PRO-Updates: 3.0.124 nutzen

Mon, 19 Oct 2026 20:22:54 +0200

LONDON (IT BOLTWISE) – Betroffene Kopien von „Rank Math PRO“ zwischen 15. Oktober 20:02 UTC und 16. Oktober 07:12 UTC enthielten laut Rank Math einen Malware-Code mit selbst wiederherstellender Hintertür. Wer solche Builds installiert und aktiviert hat, soll den WordPress-Server als kompromittiert behandeln, bis eine komplette Wiederherstellung... Weiterlesen

Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor

Mon, 19 Oct 2026 20:22:44 +0200

Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware, Rank Math said in a security notice published on October 16. Any site that installed and activated one of those copies... Weiterlesen

Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor

Mon, 19 Oct 2026 19:13:25 +0200

Stolen UpdraftCentral Keys Are Backdooring WordPress Sites

Mon, 19 Oct 2026 10:31:33 +0200

UpdraftPlus / UpdraftCentral Remote Management Key Compromise – Backdoor Deployment 4M+ CVSS 9.8 An attacker holding valid UpdraftCentral dashboard keys is installing backdoor plugins on connected WordPress sites. The campaign ran continuously through an 18-hour window on 18-19 October. Patchstack blocks UpdraftCentral remote commands and has... Weiterlesen

U.S. Agencies Warn AI Agents Could Exploit Security Flaws and Establish Hidden Backdoors

Mon, 19 Oct 2026 09:32:59 +0200

U.S. agencies have warned that advanced AI agents could exploit security flaws, break out of their assigned limits, and leave hidden backdoors behind. New guidance from NIST, the National Security Agency, and CISA urges AI developers to prepare for incidents in which agents take harmful actions without being told to do so. Released on October […]... Weiterlesen

U.S. Agencies Warn AI Agents Could Exploit Security Flaws and Establish Hidden Backdoors

Mon, 19 Oct 2026 08:59:58 +0200

Hackers Exploit Critical Collabora Online Flaw to Backdoor Nextcloud Servers

Sat, 17 Oct 2026 07:48:15 +0200

Hackers are exploiting a critical flaw in the Collabora Online Built-in CODE Server app for Nextcloud, with users reporting web shells on compromised servers. Tracked as CVE-2026-110447, the vulnerability allows remote attackers to run operating system commands without logging in. It affects the richdocumentscode app before version 26.4.303 and... Weiterlesen

AI-Assisted Hackers Compromise Government Linux Servers to Deploy Backdoors and Steal Credentials

Sat, 17 Oct 2026 07:32:34 +0200

Hackers used AI-assisted scripts to compromise government Linux servers, harvest administrator credentials, and establish persistent backdoors during a campaign observed between October 2025 and April 2026. The cluster remains unattributed. Under Unit 42’s attribution framework, “UNK” indicates that researchers have not determined whether the... Weiterlesen

AI-Assisted Hackers Compromise Government Linux Servers to Deploy Backdoors and Steal Credentials

Sat, 17 Oct 2026 07:03:10 +0200

Fake developer job offer sent me a GitHub repo with a hidden folder-open task and credential-stealing Node.js backdoor (static analysis + hashes)

Sat, 17 Oct 2026 04:15:26 +0200

I was contacted about a full-stack developer job involving an existing card/casino web project. I received a GitHub collaborator invitation. The files were statically analyzed **without executing the suspicious scripts during the analysis**. It contained an obfuscated loader disguised as an ESLint check. Sharing the findings so other developers... Weiterlesen

AOMEI Backupper: Angreifer manipulierten Update-Server für Minuten und lieferten Backdoor aus

Fri, 16 Oct 2026 20:33:05 +0200

LONDON (IT BOLTWISE) – Angreifer haben zwischen Ende Mai und Mitte Juli 2026 Update-Dateien bei AOMEI Backupper für wenige Minuten pro Fenster manipuliert. Wer in so einem Zeitfenster prüfte, lud eine präparierte Paketdatei herunter und führte sie anschließend mit den Rechten des Backupper-Dienstes aus. Betroffen sind laut den beteiligten... Weiterlesen

Attackers Tampered with AOMEI Backupper’s Update Servers for Minutes to Deliver a Backdoor

Fri, 16 Oct 2026 20:32:53 +0200

Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup program that checked for an update during one of those windows would download and run a backdoor. Google Threat Intelligence Group,... Weiterlesen

Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor

Fri, 16 Oct 2026 20:26:14 +0200

Backdooring Open-Weight AI Models

Fri, 16 Oct 2026 14:26:08 +0200

This is a problem: Any open model whose weights have been edited can carry a backdoor, whether it’s a task-specific fine-tune, a merged adapter or an abliterated build. We have abliterated models in the title because it’s the most popular reason people download modified weights without verifying what’s inside. Abliteration is a cheap fine-tune... Weiterlesen

Backdooring Open-Weight AI Models

Fri, 16 Oct 2026 13:57:36 +0200

Chinese Hackers Exploit BeyondTrust Zero-Day to Gain Root Access and Deploy Backdoors

Fri, 16 Oct 2026 09:39:28 +0200

A suspected China-linked espionage group exploited a zero-day vulnerability in BeyondTrust Remote Support appliances to gain access, reach root privileges and install tools for continued access. Google Threat Intelligence Group (GTIG) says the activity took place in late August 2026, before BeyondTrust disclosed the flaw on October 15. The... Weiterlesen

Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers

Thu, 15 Oct 2026 23:30:02 +0200

Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. [...] Weiterlesen

ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More

Thu, 15 Oct 2026 21:35:10 +0200

Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that’s an actual feature. And somehow, it fits right in with this week's security stories. The rest gets interesting in different ways. A small permission can lead to a big theft. A trusted login can hide the wrong person. Old bugs are finding new victims,... Weiterlesen

A signed PDF viewer that quietly takes orders: the QuartzLine “zenith” backdoor

Thu, 15 Oct 2026 10:45:26 +0200

2026-10-09 • Rogue Authority • Squiblydoo • win.cloudhaze Open article on Malpedia Weiterlesen

Who Is Planting Backdoors in Ledger Crypto Wallets?

Thu, 15 Oct 2026 09:28:20 +0200

The theft last week of an estimated $100 million in crypto using a hardware backdoor planted in Ledger wallets points to a sophisticated and systematic attack aimed at subverting crypto wallets sold by legitimate resellers in Asia and Europe This article has been indexed from ZERO DAY Read the original article: Who Is Planting Backdoors in Ledger... Weiterlesen

Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App

Thu, 15 Oct 2026 09:19:17 +0200

Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. A web shell is a small file that executes any command an attacker sends via a web request, with the rights of... Weiterlesen

Hackers Exploit Ninja Forms and WooCommerce Plugin Flaws to Plant Hidden Admin Backdoors

Mon, 12 Oct 2026 21:30:32 +0200

Security researchers have uncovered an active campaign targeting WordPress websites. Attackers are abusing two stored cross-site scripting bugs in unrelated plugins. The goal is to plant backdoors and hidden administrator accounts on victim sites. Patchstack researchers spotted the campaign in early October 2026. The two affected plugins are Ninja... Weiterlesen

New Stealthy Linux Backdoors Target Telecoms, Masquerade as Email Traffic

Mon, 12 Oct 2026 21:28:42 +0200

Rapid7 has uncovered new BPFDoor, BPF Rekoobe and AVERAT malware variants targeting telecom and network-edge appliances in South Korea and Taiwan Weiterlesen

Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan

Mon, 12 Oct 2026 20:41:17 +0200

Linux backdoors targeting telecom and network appliances in South Korea and Taiwan have been disguising their traffic as email services and seemingly legitimate processes to blend in and evade detection. Threat actors are known to name their malicious software after a legitimate operating system component or a process as a defense evasion measure.... Weiterlesen