cve5 articles
Unknown Threat Actor Chained SonicWall Zero-Days to Root Before Anyone Knew They Existed
A previously unknown threat actor (UTA0533) exploited two zero-day vulnerabilities — CVE-2026-15409 and CVE-2026-15410 — in SonicWall SMA 1000 series VPN appliances before patches were publicly released, chaining them together to achieve root-level access on compromised devices. The attacker deployed custom malware, including a web shell and HTTP proxy tool, modified startup scripts for persistence, and used packet capture utilities to steal LDAP credentials. While UTA0533 demonstrated advanced capability in compromising the appliances, evidence suggests they had limited success in moving laterally to other systems on the network.
Botnets in Your Living Room, Ransomware in Your Browser, and AI That Follows the Wrong Orders: This Week in Security
This week's cybersecurity recap highlights how attackers exploited ordinary, trusted systems rather than sophisticated vulnerabilities. Key incidents included Google and the FBI disrupting the NetNut residential proxy botnet (comprising at least 2 million devices), a fake GitHub PoC repository delivering the ChocoPoC RAT via a malicious dependency, and AI-generated browser ransomware leveraging Chromium's File System Access API. Additional notable stories covered WhatsApp username impersonation concerns, a Scattered Spider suspect extradited to the US, and multiple phishing-as-a-service toolkits emerging in the wild. The overarching theme was misplaced trust — in home devices, clean-looking code, identity reset flows, and browser permissions — underscoring that attackers need little more than a familiar, overlooked entry point.
Bad Epoll: The Linux Root Bug That Anthropic's AI Walked Right Past
A newly discovered Linux kernel vulnerability called Bad Epoll (CVE-2026-46242) allows unprivileged users to gain root access by exploiting a use-after-free race condition in the kernel's epoll code, affecting Linux desktops, servers, and Android devices. Researcher Jaeyoung Chung developed a highly reliable exploit that succeeds roughly 99% of the time, and notably can be triggered from within Chrome's renderer sandbox. A fix is available via upstream commit a6dc643c6931, though there is no workaround since epoll cannot be disabled, and an Android-specific exploit remains in development.
Oracle E-Business Suite Exploited Before Anyone Even Published the Attack Code
A critical vulnerability in Oracle E-Business Suite's Payments module (CVE-2026-46817, CVSS 9.8) was actively exploited just six weeks after Oracle patched it in May, with attacks beginning before any public proof-of-concept code was released, suggesting the attacker reverse-engineered Oracle's patch or used a private exploit. The targeted, low-volume nature of the attacks — only six attempts from a single source — indicates deliberate reconnaissance rather than broad scanning. The incident reflects a growing trend of attackers rapidly weaponizing enterprise software patches, with around 950 EBS instances currently exposed to the public internet.
Nine-Year-Old Linux Kernel Bug Quietly Handed Root Access to Anyone Who Asked
A security flaw sitting undetected in the Linux kernel for nine years has been found to allow unprivileged users to execute commands as root on a wide range of major distributions.