Aggregator

HackerNews 编译，转载请注明出处： FreeScout 客服平台存在一个最高危漏洞，允许黑客在无需用户交互、无需身份认证的情况下实现远程代码执行（RCE）。 该漏洞编号为 CVE-2026-28289，可绕过此前针对另一个 RCE 漏洞（CVE-2026-27636）的修复，后者仅能被拥有上传权限的认证用户利用。 应用安全厂商 OX Security 的研究人员表示，攻击者只需向 FreeScout 中配置的任意邮箱发送一封精心构造的邮件，即可利用该新漏洞。 官方此前的修复方案试图通过修改带受限后缀或以点开头的文件名，来阻止危险文件上传。 OX 研究团队发现，可在文件名前插入零宽空格（Unicode U+200B） 绕过新加入的校验机制，因为该字符不会被视为可见内容。 后续处理会自动移除该字符，使文件最终以点文件（dotfile）形式保存，从而完全绕过最新安全检查，再次触发 CVE-2026-27636 的利用条件。 攻击利用链（来源：OX Research） 研究人员称，更严重的是，只需向 FreeScout 配置的邮箱发送带恶意附件的邮件，即可触发 CVE-2026-28289。 系统会将附件保存到 /storage/attachment/ 目录，攻击者可通过 Web 界面访问上传的恶意载荷，无需认证、无需点击即可在服务器上执行命令，属于零点击漏洞。 厂商在安全公告中表示：“FreeScout 1.8.206 存在补丁绕过漏洞，任何拥有文件上传权限的认证用户，可通过在文件名前加零宽空格上传恶意 .htaccess 文件绕过安全检查，实现服务器 RCE。” FreeScout 是一款开源客服与共享邮箱平台，用于企业管理客服邮件与工单，是可自托管的 Zendesk / Help Scout 替代方案。 该项目在 GitHub 有 4100 Star、620+ Fork；OX 研究称 Shodan 扫描发现 1100 个公开暴露实例，说明其使用范围广泛。 CVE-2026-28289 影响 1.8.206 及以下所有版本，已于四天前发布的 1.8.207 版本中修复。 FreeScout 团队警告，成功利用 CVE-2026-28289 可导致服务器完全被控、数据泄露、内网横向移动、业务中断，建议立即更新补丁。 OX Research 同时建议，即使升级到 1.8.207，也应在 FreeScout 服务器的 Apache 配置中禁用 AllowOverride All。 截至发稿，暂未观察到 CVE-2026-28289 在野利用，但鉴于漏洞性质，短期内出现恶意攻击的风险极高。 消息来源：bleepingcomputer.com； 本文由 HackerNews.cc 翻译整理，封面来源于网络； 转载请注明“转自 HackerNews.cc”并附上原文

HackerNews 编译，转载请注明出处： 网络安全研究人员警告，在美以针对伊朗发动代号为 Epic Fury 和 Roaring Lion 的联合军事行动后，报复性黑客行动主义活动激增。 Radware 在周二的报告中表示：“中东地区的黑客行动主义威胁呈现高度不均衡态势，Keymous+ 和 DieNet 两个组织发起了 2 月 28 日至 3 月 2 日期间近 70% 的攻击活动。” 首例分布式拒绝服务（DDoS）攻击由 Hider Nex（又名 Tunisian Maskers Cyber Force）于 2026 年 2 月 28 日发起。 据 Orange Cyberdefense 披露的信息，Hider Nex 是一个支持巴勒斯坦事业的突尼斯秘密黑客行动主义组织。该组织采用攻击 + 泄密策略，将 DDoS 攻击与数据泄露相结合，泄露敏感信息以推进其地缘政治议程。该组织于 2025 年年中出现。 统计显示，共出现 149 起黑客行动主义 DDoS 攻击宣称，针对 16 个国家 110 家不同机构。攻击由 12 个不同组织实施，其中 Keymous+、DieNet 和 NoName057 (16) 占全部活动的 74.6%。 在这些攻击中，绝大多数（107 起）集中在中东地区，重点针对公共基础设施和国家级目标。欧洲成为同期全球 22.8% 攻击活动的目标。全球近 47.8% 的受攻击机构属于政府部门，其次是金融（11.9%）和电信（6.7%）行业。 Radware 表示：“该地区数字战线与实体战线同步扩大，黑客组织同时针对中东更多国家发起攻击，规模前所未有。”“区域内攻击高度集中在三个国家：科威特、以色列和约旦，分别占攻击宣称总量的 28%、27.1% 和 21.5%。” 根据 Flashpoint、Palo Alto Networks Unit 42 和 Radware 的数据，除上述三个组织外，参与破坏性行动的还包括 NOS、CEA、Sylhet Gang、313 Team、Handala Hack、APT Iran、Cyber Islamic Resistance、Dark Storm Team、FAD Team、Evil Markhors 和 PalachPro。 当前网络攻击范围如下： ·     亲俄黑客组织 Cardinal 和 Russian Legion 宣称攻破以色列军事网络，包括铁穹导弹防御系统。 ·     监测到活跃的 SMS 钓鱼活动，攻击者使用假冒以色列本土前线司令部 RedAlert 应用的恶意副本，投放移动监控与数据窃取恶意软件。CloudSEK 表示：“攻击者以战时紧急更新为幌子，诱导受害者侧载恶意 APK，在可用的警报界面下隐藏侵入式监控引擎，针对高度警惕的人群实施监控。” ·     伊朗伊斯兰革命卫队（IRGC）针对中东能源与数字基础设施发起攻击，目标包括沙特阿美和阿联酋的一座 AWS 数据中心。Flashpoint 称，其意图是 “制造最大程度的全球经济冲击，以对冲军事层面的损失”。 ·     Cotton Sandstorm（又名 Haywire Kitten）启用旧网络身份 Altoufan Team，宣称入侵巴林多家网站。Check Point 表示：“这反映出该攻击者行动的应激性，冲突期间其极有可能进一步参与中东地区的入侵活动。” ·     Nozomi Networks 数据显示，伊朗国家背景黑客组织 UNC1549（又名 GalaxyGato、Nimbus Manticore、Subtle Snail）是 2025 年下半年第四活跃的攻击组织，其攻击重点为国防、航空航天、电信及地区政府机构，以推进伊朗地缘政治目标。 ·     伊朗主流加密货币交易所仍在运行，但已宣布调整运营，暂停或批量处理提现，并发布风险提示，建议用户为可能的网络中断做好准备。 ·     TRM Labs 全球政策主管 Ari Redbord 表示：“伊朗目前的情况并非明显的大规模资本外逃，而是市场在网络受限与监管干预下应对波动的表现。”“多年来，伊朗一直存在影子经济，其中一部分通过加密货币规避制裁，包括利用复杂的离岸基础设施。目前在战争、断网和市场波动的压力下，这套基础设施及政权利用它的能力正接受实时压力测试。” ·     Sophos 表示 “观察到黑客行动主义活动激增，但风险并未升级”，攻击主要来自亲伊朗组织，包括 Handala Hack 和 APT Iran，攻击形式包括 DDoS、网站篡改以及针对以色列基础设施的未经证实的入侵宣称。 ·     英国国家网络安全中心（NCSC）向机构发出伊朗网络攻击风险升高警报，敦促其加强安全态势，应对 DDoS、钓鱼活动和对 ICS 的攻击。 Halcyon 勒索软件研究中心高级副总裁、前 FBI 网络部副主任 Cynthia Kaiser 在 LinkedIn 发文称，伊朗素有利用网络行动报复 “所谓政治冒犯” 的先例，她补充称，此类活动越来越多地结合勒索软件。 Kaiser 补充：“伊朗长期以来对针对美国、以色列及其他盟国的民间网络行动持默许或至少是放任态度。”“原因在于，掌握网络犯罪分子能为政府提供更多行动选择。伊朗在考虑如何回应美以军事行动时，若认为这些网络组织能产生有效报复效果，很可能会启用他们。” 网络安全公司 SentinelOne 也以高可信度评估认为，以色列、美国及盟国机构很可能面临直接或间接攻击，重点行业包括政府、关键基础设施、国防、金融服务、教育和媒体。 Nozomi Networks 表示：“伊朗威胁组织历来愿意将间谍活动、破坏行动和心理战结合，以实现战略目标。”“在局势不稳定时期，此类行动往往会加剧，目标超出直接冲突区域，涵盖关键基础设施、能源网络、政府机构和私营企业。” 为应对实体冲突带来的网络风险，建议机构启用持续监控，以匹配升级的威胁活动，更新威胁情报特征、缩小外部攻击面、对联网资产开展全面暴露面检查，验证 IT 与 OT 网络的正确隔离，确保 IoT 设备有效隔离。 CrowdStrike 对抗敌对行动主管 Adam Meyers 向 The Hacker News 表示：“在以往冲突中，伊朗网络组织会将行动与更广泛战略目标对齐，加大对能源、关键基础设施、金融、电信、医疗等目标的施压与曝光度。” “伊朗对手的攻击技术持续进化，已从传统入侵扩展到云和身份为中心的行动，这使其能够在混合企业环境中快速行动，规模与影响进一步提升。” 消息来源：thehackernews.com； 本文由 HackerNews.cc 翻译整理，封面来源于网络； 转载请注明“转自 HackerNews.cc”并附上原文

A vulnerability labeled as critical has been found in ThemeREX Verse Plugin up to 1.7.0 on WordPress. This affects an unknown part. Such manipulation leads to improper control of filename for include/require statement in php program ('php remote file inclusion'). This vulnerability is uniquely identified as CVE-2026-28128. The attack can be launched remotely. No exploit exists.

A vulnerability marked as critical has been reported in axiomthemes Little Birdies Plugin up to 1.3.16 on WordPress. This vulnerability affects unknown code. Performing a manipulation results in improper control of filename for include/require statement in php program ('php remote file inclusion'). This vulnerability was named CVE-2026-28129. The attack may be initiated remotely. There is no available exploit.

A vulnerability, which was classified as critical, has been found in Crocoblock JetEngine Plugin up to 3.7.2 on WordPress. The impacted element is an unknown function. This manipulation causes code injection. This vulnerability is tracked as CVE-2026-28134. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability was found in WP Chill Filr Plugin up to 1.2.12 on WordPress and classified as critical. Affected is an unknown function. Executing a manipulation can lead to unrestricted upload. This vulnerability is registered as CVE-2026-28133. It is possible to launch the attack remotely. No exploit is available.

A vulnerability was found in AndonDesign UDesign Plugin up to 4.14.0 on WordPress. It has been rated as problematic. Impacted is an unknown function. Performing a manipulation results in cross site scripting. This vulnerability is reported as CVE-2026-28130. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability classified as critical has been found in Salesforce Login with Salesforce Plugin up to 1.0.2 on WordPress. Impacted is an unknown function. The manipulation leads to improper authentication. This vulnerability is referenced as CVE-2026-2418. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability was found in WP Royal Royal Elementor Addons Plugin up to 1.7.1049 on WordPress. It has been classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to inclusion of functionality from untrusted control sphere. This vulnerability is documented as CVE-2026-28135. The attack can be initiated remotely. There is not any exploit available.

A vulnerability was found in QuanticaLabs MediCenter Plugin up to 14.9 on WordPress. It has been classified as problematic. This vulnerability affects unknown code. This manipulation causes cross site scripting. This vulnerability is registered as CVE-2026-28137. Remote exploitation of the attack is possible. No exploit is available.

M365Pwned Red Team tooling for Microsoft 365 exploitation via Microsoft Graph API. Two WinForms GUI tools for enumerating,

The post M365Pwned: Red Team tooling for Microsoft 365 exploitation via Microsoft Graph API appeared first on Penetration Testing Tools.

An urgent security advisory from Cisco warns that multiple vulnerabilities in Cisco Catalyst SD-WAN Manager could allow attackers to bypass authentication, gain root access, and overwrite critical files. Two of these vulnerabilities are already being exploited in the wild by hackers, making immediate remediation critical.​ The advisory details five vulnerabilities, led by CVE-2026-20129, a critical […]

The post Cisco Catalyst SD-WAN Vulnerabilities Allow Attackers to Gain Root Access appeared first on Cyber Security News.

A vulnerability labeled as critical has been found in Drag and Drop Multiple File Upload Plugin up to 1.3.9.5 on WordPress. This affects the function dnd_upload_cf7_upload. The manipulation results in unrestricted upload. This vulnerability is known as CVE-2026-3459. It is possible to launch the attack remotely. No exploit is available.

The conflicts of the twenty-first century are increasingly inaugurated not by the roar of missiles, but by imperceptible

The post The Master Key: How Cyber-Kinetic Operations Decapitated the Iranian Leadership in “Operation Epic Fury” appeared first on Penetration Testing Tools.

A vulnerability identified as problematic has been detected in HCLSoftware Sametime up to 12.0.25 on iOS. The impacted element is an unknown function of the component Application Log. The manipulation leads to sensitive information in log files. This vulnerability is traded as CVE-2026-21786. An attack has to be approached locally. There is no exploit available. You should upgrade the affected component.

A vulnerability categorized as problematic has been discovered in e-plugins Lawyer Directory Plugin up to 1.3.2 on WordPress. The affected element is an unknown function. Executing a manipulation can lead to cross site scripting. This vulnerability appears as CVE-2026-28127. The attack may be performed from remote. There is no available exploit.

A vulnerability was found in AndonDesign UDesign Plugin up to 4.14.0 on WordPress. It has been rated as problematic. Impacted is an unknown function. Performing a manipulation results in cross site scripting. This vulnerability is reported as CVE-2026-28130. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability was found in Huawei HarmonyOS 6.0.0. It has been declared as problematic. This issue affects some unknown processing of the component Window Module. Such manipulation leads to double free. This vulnerability is documented as CVE-2026-28537. The attack needs to be performed locally. There is not any exploit available.

A vulnerability was found in QuanticaLabs MediCenter Plugin up to 14.9 on WordPress. It has been classified as problematic. This vulnerability affects unknown code. This manipulation causes cross site scripting. This vulnerability is registered as CVE-2026-28137. Remote exploitation of the attack is possible. No exploit is available.

Over the past year, South Asia has witnessed a marked proliferation of cyberespionage offensives targeting state apparatuses and

The post Under the Radar: How the SloppyLemming Syndicate Infiltrated South Asia’s Nuclear and Energy Sectors appeared first on Penetration Testing Tools.