|
|
Hi there, this is your daily ☕️ Cyberpresso.
|
|
|
In today's Cyberpresso:
|
|
🔓 Ransomware gangs exploit TeamCity flaw 🏦 Android trojan steals banking PINs 📧 Roundcube email flaw under active attack 🐛 Next.js flaw enables remote code execution 🥷 New trick hides malware from EDR Plus: 💡 6 strategies & tactics, 🎁 8 other news you might like, 🧰 6 tools, and 📚 5 papers.
|
|
Retail and e-commerce account for 46.6% of agentic AI traffic, more than any other industry. AI agents already browse products, manage accounts, and check out for shoppers. But can you tell which agents are legitimate and which are malicious? The Guide to AI, Agentic Traffic, and Cyberthreats for Retail and E-Commerce shows you how to: • 🛍️ Prepare your storefront for AI-driven commerce. • 🔎 Identify trusted agents and malicious automation. • 🛡️ Protect product data, accounts, and checkout. |
|
|
🔓 Ransomware gangs exploit TeamCity flaw
LINK
|
- Ransomware gangs are now exploiting a critical JetBrains TeamCity authentication bypass flaw, CISA warned federal agencies on Wednesday, adding it to its actively-exploited catalog and flagging the abuse two months after JetBrains patched it in July.
- The bug (CVE-2026-63077), patched July 25 in TeamCity On-Premises versions 2025.11.7 and 2026.1.3, lets an unauthenticated attacker with HTTP(S) access abuse the agent polling protocol to skip authentication checks and run operating system commands with the TeamCity server process's privileges.
- A successful attack can expose stored credentials, configurations and data, modify server state, and taint build artifacts and downstream CI/CD pipelines; Shadowserver tracks about 160 servers still unpatched, and those who cannot patch should limit access to trusted networks.
|
🏦 Android trojan steals banking PINs
LINK
|
- A new Android banking trojan called RemControl poses as the third-party TVTap IPTV app on fake Google Play Store pages, then takes over infected phones to steal banking PINs from customers of more than 30 banks.
- The dropper starts a VPN that blocks the Google Play Store app so Google Play Protect cannot scan it, then it asks for Accessibility Service permission to overlay banking apps with fake login screens that capture PINs, mobile banking codes and card expiry dates.
- RemControl is sold as malware-as-a-service, hides its C2 server address in encrypted text on two public Telegram channels, and signs each install with a unique certificate to defeat hash and certificate detection; Group-IB tracks the operator as UNKK.
|
📧 Roundcube email flaw under active attack
LINK
|
- A critical flaw in Roundcube Webmail is now being exploited in the wild, pushing administrators to urgently update any exposed installations before attackers reach them.
- The bug (CVE-2026-48842) is a pre-authentication SQL injection in Roundcube's virtuser_query plugin, letting an attacker send crafted input to manipulate a database query without logging in, by abusing a backslash-escaping bypass in PHP's preg_replace.
- Canada's Cyber Center confirmed active exploitation in advisory AV26-503 on September 21, 2026; the fix ships in Roundcube Webmail 1.6.16 and 1.7.1, with older 1.6.x and 1.7.x releases affected.
|
🐛 Next.js flaw enables remote code execution
LINK
|
- A critical flaw in Next.js, tracked as CVE-2026-94545, lets attackers run code on the server by feeding malicious SVG content into the Node.js ImageResponse feature of the next/og package during image generation.
- The bug, rated critical under CVSS v4, can be triggered remotely over the network with no login and no user interaction whenever an application embeds attacker-controlled input from a URL parameter, form field, or API request directly inside SVG elements, attributes, or styles.
- It affects Next.js versions 16.2.0 up to before 16.3.6, and developers should upgrade to 16.3.6; the Edge implementation of ImageResponse is not affected, and where patching is delayed, stop passing user-controlled input into SVG content.
|
🥷 New trick hides malware from EDR
LINK
|
- Researchers at Flashpoint validated "process parameter poisoning," a Windows evasion trick that hides malicious payloads inside a process's own startup structures, letting attackers inject code without triggering the memory operations endpoint detection and response tools normally watch for.
- An attacker already running code on a Windows machine creates a "sacrificial process" and abuses the startup parameters Windows passes into it, avoiding the VirtualAllocEx(), WriteProcessMemory(), and MapViewOfFile2() calls that EDR products traditionally monitor to spot process injection.
- Flashpoint found no public malware using it yet, but combining the technique with DLL unhooking and blocking non-Microsoft DLLs silenced an open-source EDR and its XDR component; defenders should inspect process parameters and monitor what processes actually do.
|
|
Want to get the most out of ChatGPT?
ChatGPT is a superpower if you know how to use it correctly.
Discover how HubSpot's guide to AI can elevate both your productivity and creativity to get more things done.
Learn to automate tasks, enhance decision-making, and foster innovation with the power of AI.
Other
news & articles you might like
-
There's a new way to break RSA that's faster than anything we've seen before
LINK
-
Placeholder domain used in dev docs now serves ClickFix attacks
LINK
-
Malicious Firefox extension poses as PDF identity verifier to hijack Google accounts
LINK
-
Operation conflict compass deploys VelvetCake PowerShell malware through malicious LNK files
LINK
-
New windows malware built to survive takedowns with a hidden P2P command network
LINK
-
Australian prime minister says OpenAI agent accessed government health website, raises 'extreme concern'
LINK
-
MacSync under the microscope: new delivery methods and a new payload
LINK
-
New Galago ransomware operation emerges with links to Panzer Group
LINK
|
|
🛠️ Trending tools
|
Halo: detects deepfakes and synthetic media across text, image, and audio through an API, helping fraud and trust teams block attacks.
LINK
|
|
Execlave: governs autonomous AI agents with tiered autonomy levels, real-time spend caps, kill switches, and audit logs mapped to SOC 2, EU AI Act, and ISO 27001.
LINK
|
|
qsa.sh: scans your public IP for open ports and known vulnerabilities using naabu, nmap, and nuclei, streaming results to your terminal via one curl command
LINK
|
|
Cynative Security Research Agent: open-source AI CLI that answers plain-language security questions across code, cloud, and Kubernetes using read-only, IAM-enforced production access.
LINK
|
|
Aegisora: an open-source proxy for securing LLM agents with least-privilege API access, PII masking, prompt-injection blocking, and audit logging in production.
LINK
|
|
Cybermes: an autonomous framework for offensive security, bug bounty, and red teaming, using reasoning skills and multi-model LLM orchestration.
LINK
|
|
|
|
📚 Trending research papers
|
Private-data chatbots can now answer questions from sensitive documents while spending their limited privacy protection only when they actually need the private data, wasting far less budget and staying accurate under strict privacy limits.
LINK
|
|
Model-stealing attacks can now copy an image-recognition system's full blueprint, both its hidden design and its internal settings, without knowing anything about its structure beforehand, making proprietary vision models easier to clone.
LINK
|
|
SilentLedger lets private blockchains stay confidential yet fully auditable, so regulators can uncover identities and amounts when justified without users or auditors ever interacting, matching or beating existing privacy systems on speed.
LINK
|
|
Cybercrime infrastructure ads can be automatically spotted on Telegram, revealing that ~19% of over a million messages hawk criminal hosting or VPNs and that one community drives half of them, helping investigators prioritize targets.
LINK
|
|
Crypto mixer laundering now has the first public dataset of 9,300 tagged transactions spanning 1.1 billion across 27 real cases, plus a detection tool that flags laundering flows better than existing methods.
LINK
|
|
|
|
|
Our AI Academy has 330+ step-by-step tutorials on ChatGPT, Claude, Perplexity, and every tool that matters. No fluff — just practical workflows you can use at work. Try it free for 7 days.
|
|
💬 How did you find today's edition?
We read every reply — just reply to this email and let us know how we can improve!
|
|
