|
🔓 Critical Citrix flaw under active attack
LINK
|
- Attackers are actively exploiting a critical pre-authentication command-injection flaw (CVE-2026-88771) in Citrix NetScaler ADC and NetScaler Gateway to open reverse shells, create privileged accounts, and keep long-term access, according to LevelBlue's threat-hunting team.
- Rated critical (CVSS 9.5), the bug lets an unauthenticated attacker inject commands via authentication fields that pull down malware, stage the appliance's configuration for theft, and plant implants, with some requests using backtick substitution or spacing tricks to dodge exact-match detection.
- Citrix released patches on September 27, with fixed standard and FIPS builds listed; defenders should patch, review local accounts, reset authentication, and hunt behaviorally, since the Perl payload deletes its own archives and self-removes to limit evidence.
|
🎮 Discord breach exposes 28M accounts
LINK
|
- Double Counter, a verification and anti-alt account service used by Discord communities, confirmed that an attacker spent nearly six hours inside its infrastructure on October 4th, exposing data tied to 28 million accounts.
- The attacker broke into an abandoned server from the company's old OVH hosting on October 3rd, exploited a bug in a publicly exposed analytics tool to grab an administrator's login, then used it to reach the cloud infrastructure and steal a Discord bot token.
- Exposed data included Discord usernames, IP addresses, and approximate location, which could help profile accounts across communities; Discord passwords and stored card numbers were not exposed, and the attacker ran up $7,316 in fraudulent charges on three cards, with two customers refunded.
|
📌 Hackers exploit critical Atlassian flaw
LINK
|
- Hackers have begun exploiting a critical flaw in Atlassian Data Center products (CVE-2026-21589, CVSS 9.3) that lets an unauthenticated attacker read sensitive files in the web root, affecting Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye.
- The bug is a path traversal weakness where double-colon (::) sequences are treated as path separators, so a single crafted request turns a string into a directory path like ../../../../WEB-INF/web.xml, exposing tokens, credentials, and keys, though attackers must already know the exact file name and path.
- Exploitation hit watchTowr's and Previdian's honeypots about two hours after watchTowr published its analysis on October 6, with 15 attempts from three IPs in Japan and the U.S.; Atlassian advises removing instances from the public internet and blocking requests via a firewall rule, Tomcat's RewriteValve, or urlrewrite.xml for Bitbucket.
|
💻 Malware hides C2 servers in GitHub poem
LINK
|
- A cryptomining botnet called PoeLLM is hiding its command-and-control server address inside a poem posted on GitHub, letting infected machines decode the current server location on their own, according to Black Lotus Labs.
- Active since April 2026 and tracked as Canto Incognito, the operation has hit over 3,400 servers, mostly in the US and Western Europe, by breaking into exposed AI/LLM tools like LiteLLM and Ollama, plus the Gotenberg PDF converter and Gitea.
- Attackers scan for default ports, then send a crafted POST request exploiting a command injection bug in LiteLLM (CVE-2026-42271) to install XMRig and Iron miners; the malware pulls four words from the poem and maps them to numbers forming the server's IPv4 address.
|
|
