(rapid7.com) Critical Arbitrary Code Execution Vulnerability in GitLab CI/CD Regular Expression Compiler (CVE-2026-97229)

In brief - This article discusses a critical remote code execution vulnerability (CVE-2026-97229) in GitLab CE and EE, urging self-managed instance administrators to apply urgent patches.

Technically - This article describes an integer overflow (CWE-190) within the CI/CD regular expression compiler of the Ruby Onigmo engine. The vulnerability is triggered when a specially crafted regular expression, initially validated in US-ASCII, is recompiled for UTF-8 encoding against a specific repository path. This overflow leads to the generation of invalid instructions and a loss of control-flow integrity, allowing an attacker to execute arbitrary OS commands as the GitLab git user. Successful exploitation requires the ability to commit a malicious .gitlab-ci.yml file and a UTF-8 repository path to a public project.

Source: https://www.rapid7.com/blog/post/etr-cve-2026-97229-critical-unauthenticated-remote-code-execution-in-gitlab

#Cybersecurity

(darkowl.com) The AI Arms Race: How Cybercriminals Are Outpacing Defenses with Autonomous Ransomware and Generative AI Threats

In brief - This article examines the escalating AI arms race in cybersecurity, highlighting how threat actors are leveraging artificial intelligence to automate and accelerate ransomware attacks. It emphasizes the urgent need for organizations to adopt AI-driven defenses to counter increasingly sophisticated, machine-speed threats.

Technically - This article details the weaponization of generative AI to enhance phishing via hyper-personalization and the use of AI to shrink the window between CVE publication and exploit development to 10-15 minutes. It describes how AI is used for code obfuscation to bypass signature-based detection and highlights the 'JadePuffer' operation, where an autonomous LLM agent executed a full ransomware lifecycle—including reconnaissance, lateral movement, and encryption—by exploiting CVE-2025-3248 in Langflow. The text warns that autonomous agents operate at machine speed, rendering traditional friction-based security controls and static alert thresholds obsolete.

Source: https://www.darkowl.com/blog-content/ai-is-rewriting-the-ransomware-playbook/

#ThreatIntelligence #ThreatIntel #Cybersecurity #Infosec

(cert.se) GitLab Patches Critical Remote Code Execution Vulnerability in CI/CD Pipeline

In brief - This article announces critical security updates for GitLab Community and Enterprise Editions to address a severe vulnerability.

Technically - This article details CVE-2026-97229, a critical vulnerability with a CVSS score of 10.0 that allows unauthenticated remote code execution (RCE) on the server. The flaw is triggered via a specially crafted regular expression within a CI/CD configuration and affects versions 19.2 (prior to 19.2.8), 19.3 (prior to 19.3.5), and 19.4 (prior to 19.4.2).

Source: https://www.cert.se/2026/10/gitlab-rattar-kritisk-sarbarhet.html

#Cybersecurity

(truesec.com) Ukrainian Strikes on Yandex Data Centers Disrupt Russian AI and Internet Infrastructure

In brief - This article discusses Ukrainian drone and missile attacks on Yandex data centers in Russia, aimed at disrupting the country's sovereign internet infrastructure and AI capabilities.

Technically - This article highlights the destruction of critical infrastructure, including two of Yandex's three supercomputers used for training the YandexGPT large language model. It clarifies a technical distinction regarding observed traffic drops, noting that the decrease was in Yandex web-crawling bots used for search indexing rather than social media bot activity. Furthermore, it addresses the long-term recovery challenges for Russia's restricted internet infrastructure due to international sanctions and the lack of available cloud service alternatives.

Source: https://www.truesec.com/hub/blog/ukrainian-attack-disrupts-russian-datacenters

#Cybersecurity

(manifold.security) High-Risk Domains in AI Agent Skills: Uncovering Hidden Threats in Automated Workflows

In brief - This article examines the security risks associated with AI agent skills, MCP servers, and plugins, highlighting how malicious components can lead agents to interact with high-risk domains and install malware.

Technically - This article details a supply chain analysis of over 5.4 million URLs in the Manifest index, identifying 121 components utilizing high-risk domains. A primary example is the 'clawrtc' skill, which executes a pip install to deploy a crypto miner that exfiltrates hostnames and MAC addresses via plain HTTP to botnet C2 servers (bottube[.]ai and rustchain[.]org). The research also identifies the use of base64-encoded payloads to deploy the Atomic macOS stealer, the hijacking of placeholder domains, and the use of lookalike domains (e.g., relay.claude-code[.]ink) to intercept agent traffic. The analysis reveals a high concentration of these risks within finance and blockchain-related skills, emphasizing the danger of agents executing unverified installation commands that create persistent background services.

Source: https://www.manifold.security/blog/high-risk-domains-agent-skills-where-they-lead

#ThreatIntelligence #ThreatIntel #Cybersecurity #Infosec

(diesec.com) GhostAction GitHub Actions Attack: Exfiltrating Secrets from Git History in Supply Chain Compromise

In brief - This article describes the GhostAction attack, where compromised maintainer accounts were used to inject malicious GitHub Actions workflows into hundreds of repositories to steal secrets.

Technically - This article details a supply chain attack utilizing compromised Personal Access Tokens (PATs) to push malicious YAML workflows named "Security Audit" or "Github Actions Security" directly to default branches. The payload exfiltrates configured GitHub Actions secrets and scans the entire git history using 'git log --all' to identify 13 specific credential patterns, including AWS, GitHub, GitLab, and various AI API keys (OpenAI, Anthropic). Stolen data is transmitted via plain HTTP to the hard-coded IP address 193.32.204[.]199.

Source: https://diesec.com/2026/10/ghostaction-github-actions-attack-steals-secrets/

#Cybersecurity

So the free-to-play period of #ARCRaiders is over and it's really good to see that the average number of players online remains high!

It would seem players are generally quite happy with the recent Frozen Trails update, which has at least me engaged again.

(blog.doyensec.com) Exploiting VBS Enclaves: Code Execution in Isolated User Mode via SFAPE.dll Vulnerabilities

In brief - This article describes a vulnerability research project that achieved arbitrary code execution within Windows Isolated User Mode (IUM) by exploiting a memory corruption flaw in the SFAPE.dll VBS enclave.

Technically - This article details a multi-stage exploit chain starting with a fixed-value 32-bit write in the SFAPE.dll Initialize function, which was used to corrupt the g_enclaveBase pointer and bypass the IsInsideEnclave range validator. This bypass enabled a TOCTOU attack in ClipboardInput to achieve a memset primitive, which was then used to pivot a credential-context map to a synthetic object in VTL0, granting arbitrary 16-byte reads and 64-bit writes in VTL1. The researchers achieved full code execution by overwriting the VertValidTargetTable (VTT) in vertdll.dll to authorize arbitrary functions and utilizing NtContinue to control CPU registers and the stack, eventually leveraging Secure Kernel syscalls for unrestricted memory copying.

Source: https://blog.doyensec.com/2026/10/13/Sfape.html

#Cybersecurity

(picussecurity.com) Critical Pre-Authentication Command Injection Vulnerability in Citrix NetScaler ADC and Gateway (CVE-2026-88771)

In brief - This article explains CVE-2026-88771, a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and Gateway that allows remote attackers to execute commands as root.

Technically - This article describes a vulnerability in the root-level Perl maintenance script 'ns_monuploadd_err.pl', which processes system logs to locate core dumps. The script uses a pipeline of grep, sed, and awk to extract a filename, but fails to sanitize the resulting string before passing it into a shell command via backticks. An attacker can trigger this by submitting a crafted username in an unauthenticated login request that mimics a 'Pitboss' crash message; when the script processes this log entry, the injected semicolon allows the attacker to break out of the 'find' command and execute arbitrary shell commands with root privileges.

Source: https://www.picussecurity.com/resource/blog/cve-2026-88771-citrix-netscaler-pre-auth-command-injection-explained

#Cybersecurity

Yesterday I decided to upgrade my current graphics card from a Radeon 6800 XT to a more recent 9070 XT. The old workhorse has kept me going for about 6 years now. It was about time. Frame rate in ARC Raiders dropped below 70 sometimes... and as you know, FPS is everything. And I refuse to lower settings to maintain stable FPS ;-)

#Linux #Radeon #Gaming #ARCRaiders

(zscaler.com) Uncovering Executables that Trigger DLL Sideloading Attacks: Techniques and Defensive Strategies

In brief - This article explains the mechanics of DLL sideloading attacks and describes how Zscaler Endpoint Context can be used to detect and prevent these threats.

Technically - This article details how attackers exploit the Windows DLL search order by placing malicious DLLs in directories searched before the legitimate system paths, allowing trusted, signed executables (such as MsMpEng.exe or Zeon Corporation binaries) to load malicious code. It highlights specific campaigns by Silver Fox and REvil that use this method to deploy ValleyRAT and ransomware. Zscaler's mitigation strategy involves using an endpoint sandbox for pre-execution analysis, correlating process-network telemetry to identify signed binaries running from atypical paths (e.g., %TEMP%), validating code-signing certificates to detect unsigned DLLs loaded by trusted hosts, and applying dynamic risk scoring to restrict network access for high-risk processes.

Source: https://www.zscaler.com/blogs/product-insights/uncover-dll-sideloading-attack-endpoint-context

#Cybersecurity

Obvious in retrospect perhaps - but one of the things I implemented in the sandbox that really pays off is a tool available for the LLMs to write notes _to the sandbox dev_ about quirks they stumble upon while executing inside the sandbox. Think of it as human users of software being encouraged to voice their opinions of how it is to work with back to the developers.

Turns out the LLMs write really insightful notes that I together with an agent choose to act upon ~80% of the time. This gives a really fast turnaround on alleviating friction and implementing actually useful features back into the sandbox env.

Apologies for the slight spam on ORLYSEC, had a few posts in the waiting queue due to a bug in the current code. Released them and well, a bit of a flood.

❤️

(blog.sucuri.net) Understanding Encryption: A Practical Guide for Website Owners

In brief - This article provides a comprehensive guide to encryption for website owners, explaining its fundamental concepts, types, and practical applications while clarifying its limitations in overall site security.

Technically - This article distinguishes between symmetric encryption (e.g., AES), which uses a single shared key for high-volume data, and asymmetric encryption (e.g., RSA, ECC), which utilizes public-private key pairs for authentication and key exchange. It details the TLS handshake process where asymmetric encryption establishes trust and a shared secret, which then becomes a symmetric session key for encrypting traffic. Furthermore, it differentiates between encryption in transit (HTTPS, SFTP, SSH), encryption at rest (disk/backup encryption), and end-to-end encryption, while emphasizing that encryption is distinct from one-way cryptographic hashing (e.g., bcrypt, Argon2) used for password storage and obfuscation techniques used by malware.

Source: https://blog.sucuri.net/2026/10/what-is-encryption-how-it-protects-your-website-and-its-data.html

#Cybersecurity

(fortinet.com) Fortinet Strengthens Global Cybercrime Cooperation Through Strategic Partnerships and Community Engagement

In brief - This article discusses Fortinet's participation in the Crime Stoppers International (CSI) 2026 Global Summit to promote cross-industry cooperation in disrupting converging cyber and financial crimes.

Technically - This article highlights the integration of threat intelligence from FortiGuard Labs with community-sourced reporting to map cybercriminal ecosystems. It emphasizes the analysis of ransomware dependencies, including the roles of access brokers, infrastructure providers, and money-laundering services, while utilizing open-source intelligence (OSINT) via the World Economic Forum’s Cybercrime Atlas to identify and disrupt malicious infrastructure and derivative intelligence.

Source: https://www.fortinet.com/blog/industry-trends/fortinet-advances-cybercrime-cooperation-at-the-csi-2026-global-summit

#ThreatIntelligence #ThreatIntel #Cybersecurity #Infosec

(elastic.co) Unmasking Apex Accelerator: A Sophisticated Web3 Scam Leveraging Malicious npm Packages and AI Infrastructure

In brief - This article details a sophisticated scam by a fake Web3 venture capital accelerator called Apex Accelerator, which targets cryptocurrency founders to deploy cross-platform information-stealing malware. The operation uses a combination of polished AI-driven services, malicious npm packages, and deceptive security audits to gain trust and compromise victim machines.

Technically - This article describes a multi-stage infection chain utilizing malicious npm packages (@apexacc/cli and @apexacc/audit) that deploy platform-specific Bun executables. On macOS, the chain uses a Rust-based verifier to download the CloudSyncD backdoor, which employs custom XOR-based string obfuscation and requests sudo privileges via a fake authorization dialog. On Windows, the attack leverages a complex sequence involving PowerShell, VBScript, and PyInstaller-packaged Python loaders that implement a UAC bypass via RPC requests to the AppInfo service. The final Windows payload is a Golang loader that performs ntdll.dll unhooking and AMSI/ETW patching before executing a native infostealer. This stealer uses a unique block-shuffle protection mechanism restored via a deterministic 64-bit number generator and targets sensitive data including AI client configurations (Claude, Cursor, Windsurf) and Chrome App-Bound encrypted keys, exfiltrating the stolen data via Telegram bots.

Source: https://www.elastic.co/security-labs/threat-command/apex-accelerator-malicious-npm-packages

#Cybersecurity

(netskope.com) Evolution and Surge of XWorm Malware: Analysis of Concurrent Versions and Rising Threat Activity

In brief - This article discusses the increased prevalence and distribution of XWorm malware, noting a significant rise in detection volume across various global regions and sectors.

Technically - This article tracks the evolution of XWorm from its initial reporting in 2024 through version 6.0 and the subsequent leak of the V6.4 builder in mid-2025. The leak catalyzed a 4x increase in detection events by Q3 2026, with four distinct versions of the malware currently operating concurrently in the wild.

Source: https://www.netskope.com/blog/xworm-reborn-from-infostealer-to-surveillance-platform

#ThreatIntelligence #ThreatIntel #Cybersecurity #Infosec

(diesec.com) FBI Seizes Domains Linked to Chinese APT Tools MicroScan and FishHub Targeting Critical Infrastructure

In brief - This article describes the FBI's seizure of seven domains used by the Chinese company Integrity Technology Group to operate the MicroScan and FishHub hacking tools. The operation targeted critical infrastructure and educational institutions globally, utilizing a combination of vulnerability scanning and spear-phishing.

Technically - This article details the use of MicroScan for network mapping via a Mirai-variant botnet and FishHub for delivering spear-phishing payloads and exfiltrating data. The threat actor employed password spraying against Microsoft Exchange using the EBurst tool, utilized SoftEther VPN for persistence, and targeted eight specific legacy vulnerabilities, including CVE-2019-11510 (Pulse Secure) and CVE-2014-6278 (Shellshock). The infrastructure included lookalike domains for Microsoft, LinkedIn, and YouTube to facilitate social engineering and malware delivery.

Source: https://diesec.com/2026/10/flax-typhoon-integrity-tech-domain-seizure/

#Cybersecurity

(opensourcemalware.com) GhostAction Phishing Campaign: Sophisticated GitHub Credential Theft via Reverse Proxy and OAuth Abuse Targeting Open-Source Developers

In brief - This article details a targeted phishing campaign by the GhostAction threat actor aimed at open-source developers to steal GitHub credentials and OAuth tokens. The campaign uses a sophisticated reverse-proxy kit to gain repository access and inject malicious CI/CD workflows for supply-chain attacks.

Technically - This article describes a reverse-proxy phishing attack utilizing the lookalike domain my-github[.]com (193.32.204[.]e199). The phishing kit captures usernames, passwords, and TOTP codes while simultaneously executing a silent GitHub OAuth device flow to obtain access tokens with 'repo', 'workflow', and 'read:org' scopes. The kit employs a wildcard DNS setup to proxy various GitHub services (e.g., api.my-github.com) and uses a secondary JavaScript controller to manage per-session redirects. Exfiltrated OAuth tokens are sent to a listener on TCP/8443, enabling the attackers to programmatically inject malicious GitHub Actions workflows designed to steal secrets from CI/CD environments.

Source: https://opensourcemalware.com/blog/ghostaction-phishing-campaign

#Cybersecurity

I love my LLM sandbox. I really do. Sure I work in cybersec and have rEaSoNs for caring about such things but telling the LLM to look up the umwelt documentation and write the config it needs to be able to run host actions (e.g, commands that cannot do the task needed inside its container) and remote into other servers (inside a container, not using full user level SSH) really feels like _this is how it should be done_.

And yeah, I sleep well knowing that even if an agent happens to hallucinate wildly it cannot take out large parts of my own - or someone else's - infrastructure.

Just needed to voice my happiness a bit.

#LLM #CyberSec