Cybersécurité

There and Back Again: Escalating Privileges Locally

Now that our infrastructure has been provisioned, including a cloud VM forwarding traffic from 443/TCP to our red team infrastructure and a SOCKS5 proxy running through a ceded access agent, the attack technique guidance can finally begin. This example will showcase the aforementioned “There and Back Again” technique to coerce and receive egressed NTLM WebDAV authentication on the internet and cover relaying that authentication to a target LDAP/LDAPS service, then using the gained access to esca

15 juil.

See it live at Black Hat USA

You’re invited to connect with the experts behind Microsoft Threat Intelligenceand Incident Response Join Microsoft Security for an exclusive evening of conv

15 juil.

SharePoint: zero-day EoP

It’s a rare Patch Tuesday which doesn’t include multiple SharePoint fixes, and today is no exception. Microsoft is aware of existing in-the-wild exploitation of CVE-2026-56164, where successful exploitation allows an attacker to elevate privileges over a network, with no existing privileges required, and low attack complexity since “an attacker does not require significant prior knowledge of the system, and can achieve repeatable success”. This is as good an example as any that a relatively low

15 juil.

Active Directory Federation Services: zero-day EoP

Active Directory administrators should note the emergence today of CVE-2026-56155, an exploited-in-the-wild elevation of privilege vulnerability in Active Directory Federation Services which allows an authorized attacker to elevate privileges locally. Eight other vulnerabilities are also published today in Active Directory Federation Services, all ranked as Important on Microsoft’s proprietary severity ranking scale. The advisory doesn’t explicitly describe the location of the attacker, but it’s

15 juil.

Zero-Day Vulnerabilities: Known Exploited

CVETitleExploitation statusPublicly disclosed?CVSS v3 base scoreCVE-2026-56155Active Directory Federation Services Elevation of Privilege VulnerabilityExploitation DetectedNo7.8CVE-2026-56164Microsoft SharePoint Server Elevation of Privilege VulnerabilityExploitation DetectedNo5.3

15 juil.

Zero-Day Vulnerabilities: Publicly Disclosed (No known exploitation)

CVETitleExploitation statusPublicly disclosed?CVSS v3 base scoreCVE-2026-50661Windows BitLocker Security Feature Bypass VulnerabilityExploitation Less LikelyYes6.1

15 juil.

1. Threat intelligence and scanning

A tool for scanning Python environments for known vulnerabilities

14 juil.

Two risks your vendor process won’t catch

IBM’s global Cost of a Data Breach Report 2025 provides up-to-date insights into cybersecurity threats and their financial impacts on organizations.

14 juil.

Et si cette cyberattaque n’était qu’un cheval de Troie ?

Les actualités Aucun article trouvé. Voir tous les articles La directive NIS 2 Alors que la menace cyber augmente et […]

14 juil.

Securing the git push pipeline: Responding to a critical remote code execution vulnerability

With the root cause identified on March, 4, 2026, at 5:45 p.m. UTC, our engineering team developed and deployed a fix to github.com at 7:00 p.m. UTC that same day. The fix ensures that user-supplied push option values are properly sanitized and can no longer influence internal metadata fields. For GitHub Enterprise Server, we prepared patches across all supported releases (3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7, 3.19.4, 3.20.0, or later) and published CVE-2026-3854. These are available today

13 juil.

Investigating for exploitation

With the immediate fix in place on github.com, we moved to the pressing question of whether anyone else found and exploited this vulnerability before the researchers reported it. A key property of this vulnerability gave us confidence in our ability to answer that question. The exploit forces the server to take a code path that is never used during normal operations on github.com. This is not something an attacker can avoid or suppress, as it is an inherent consequence of how the injection works

13 juil.

Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account

Recent npm compromises expose developers to credential theft and RCE. Learn how Shai-Hulud exploited trusted packages and what actions to take in our blog.

13 juil.

When Scale Becomes the Threat

View the history of software supply chain attacks, open source components analyzed by Sonatype

13 juil.

Application security and vulnerability management

Fix what matters. Once. aisy helps security teams turn vulnerability noise into threat models they can act on, so every finding makes the next one less likely.

13 juil.

SOC automation and offensive security

COGNNA’s AI SOC platform with intelligent SOC Agents streamlines detection, response and compliance supporting SOC teams for faster, smarter security.

13 juil.

Siemens SINEC OS

A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory. View CVE Details Affected Products Siemens SINEC OS Vendor:Siemens Product Version:RUGGEDCOM RST2428P (6GK6242-6PA00) Product Status:known_affect

13 juil.

Schneider Electric PowerChute Serial Shutdown

PowerChute is vulnerable to insufficient limitations on repeated authentication attempts across multiple endpoints. View CVE Details Affected Products Schneider Electric PowerChute Serial Shutdown Vendor:SuSE, Schneider Electric, Red Hat, Microsoft Product Version:SuSE, Schneider Electric, Red Hat, Microsoft PowerChute Serial Shutdown: <=1.4 Product Status:known_affected Remediations Vendor fix(CVE-2026-2402) PowerChute Serial Shutdown Versions 1.4 and prior: Version 1.5 of PowerChute Serial

13 juil.

Labcenter Proteus 9

The application contains a use-after-free vulnerability that can be exploited to cause memory corruption while parsing specially crafted files. This could allow an attacker to execute arbitrary code in the context of the current process. View CVE Details Affected Products Labcenter Proteus 9 Vendor:Labcenter Electronics Product Version:Labcenter Electronics Proteus: 9.1_SP4_Build_42914 Product Status:known_affected Remediations Vendor fixLabcenter recommends ensuring you are using the latest

13 juil.

Hydro-Québec Le Circuit Electrique charging station backend

Expand All + CVE-2026-20744 The charging station websocket endpoint accepts connections without proper authentication, which could lead to privilege escalation. View CVE Details Affected Products Hydro-Québec Le Circuit Electrique charging station backend Vendor:Hydro-Québec Product Version:Hydro-Québec Le Circuit Electrique charging station backend:

13 juil.

Digi International PortServer TS, Digi One SP IA

A stored cross-site scripting (XSS) vulnerability in the web management interface of the Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA allows a remote, authenticated administrator to inject script into certain system configuration fields. The script subsequently executes in the browser of a user who views the affected pages. View CVE Details Affected Products Digi International PortServer TS, Digi One SP IA Vendor:Digi International Product Version:Digi International PortSer

13 juil.

Gardyn IoT Hub

The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication. A malicious user would be able to access any device log file available in the blob storage container. View CVE Details Affected Products Gardyn IoT Hub Vendor:Gardyn Product Version:Gardyn Home Firmware:

13 juil.

OFFIS DCMTK Toolkit

An unauthenticated attacker can read worklist records from a directory outside the intended per-AE worklist storage area. In a multi-area deployment, this can cross departmental or clinic data separation. View CVE Details Affected Products OFFIS DCMTK Toolkit Vendor:OFFIS Product Version:OFFIS DCMTK: <=3.7.0 Product Status:known_affected Remediations MitigationThe maintainer was notified of these vulnerabilities and has provided a fix. The fix is included in the latest commits and can be obt

13 juil.

Confirmed: Infostealing malware

VirusTotal

13 juil.

Five things successful IT teams get right about SaaS management

Talk to 1Password's sales team to learn how SaaS Manager can help you discover, secure, and manage access to all your SaaS apps – managed and unmanaged – in one tool.

13 juil.

Cybersécurité

There and Back Again: Escalating Privileges Locally

See it live at Black Hat USA

SharePoint: zero-day EoP

Active Directory Federation Services: zero-day EoP

Zero-Day Vulnerabilities: Known Exploited

Zero-Day Vulnerabilities: Publicly Disclosed (No known exploitation)

1. Threat intelligence and scanning

Two risks your vendor process won’t catch

Et si cette cyberattaque n’était qu’un cheval de Troie ?

Securing the git push pipeline: Responding to a critical remote code execution vulnerability

Investigating for exploitation

Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account

When Scale Becomes the Threat

Application security and vulnerability management

SOC automation and offensive security

Siemens SINEC OS

Schneider Electric PowerChute Serial Shutdown

Labcenter Proteus 9

Hydro-Québec Le Circuit Electrique charging station backend

Digi International PortServer TS, Digi One SP IA

Gardyn IoT Hub

OFFIS DCMTK Toolkit

Confirmed: Infostealing malware

Five things successful IT teams get right about SaaS management

Explorer d'autres thèmes