VulnHub

A recent malware campaign has resurfaced, exploiting Hugging Face models to hijack GPU servers for cryptocurrency mining. Days after a previous takedown, attackers have planted backdoors in systems, with one model being downloaded more than 28,000 times. This poses a significant risk to organizations using these models, as their computing resources can be misappropriated for illicit mining activities. Additionally, researchers have identified a fake Solana starter kit on GitHub, which is designed to trick AI coding agents into installing a remote access Trojan (RAT) called NetSupport. This highlights the ongoing vulnerability in the AI and crypto spaces, where malicious actors are increasingly targeting users and infrastructure.

Polymarket, a prediction market platform, has paused trading after hackers exploited a vulnerability in a third-party service to deploy a malicious JavaScript script. This breach allowed the attackers to siphon off around $2.5 million in cryptocurrency. The stolen assets have been traced to a wallet believed to belong to the attackers. This incident raises concerns about the security of third-party services and the potential risks they pose to platforms relying on them. Users of Polymarket and similar services should remain vigilant about the security measures in place and how their data is protected.

Recent reports indicate that phishing emails themed around the AI company Anthropic are managing to bypass some of the leading secure email gateway (SEG) products. These emails exhibit several obvious signs of phishing, yet they are still getting through security filters that are supposed to block such threats. This situation raises concerns about the effectiveness of current email security measures, as attackers continue to find ways to exploit vulnerabilities. Users and organizations must remain vigilant against these types of emails, as they can lead to serious security breaches. It underscores the need for improved security protocols and user education regarding phishing attempts.

This week's cybersecurity updates highlight a mix of vulnerabilities and attacks that showcase both skillful tactics and careless oversights. Exposed passwords and outdated bugs are still being exploited, putting users at risk. Hackers are increasingly using trusted applications and AI tools to execute their schemes, blurring the lines of trust for unsuspecting users. In particular, banking trojans are being rented out, allowing less skilled attackers to launch sophisticated attacks. The situation underscores the need for vigilance in cybersecurity practices, as both individuals and organizations must remain aware of these evolving threats.

A new advanced persistent threat group, identified as UAT-11473, has been exploiting a serious authentication-bypass vulnerability (CVE-2026-20127) in Cisco Catalyst SD-WAN Controllers. This flaw allows attackers to bypass authentication mechanisms and deploy a custom malware framework known as KeyDrift. Organizations using Cisco's SD-WAN technology may be at risk, as this could lead to unauthorized access and potential data breaches. The situation is concerning because it highlights the vulnerabilities in widely used network management systems and the increasing sophistication of cyber threats. Companies should prioritize patching their systems to mitigate this risk and protect sensitive information.

A serious flaw in the Linux kernel's TCP implementation, identified as CVE-2026-98432, has been discovered, impacting multiple Linux distributions including Ubuntu and Red Hat Enterprise Linux (RHEL). The vulnerability has been given a CVSS score of 9.8, indicating its severity. Researchers from Anthropic reported that they were able to create an exploit that allows remote attackers, without any credentials, to execute commands as the root user on affected servers. This poses a significant risk to the security of Linux systems, particularly in environments where these distributions are commonly used. Users and administrators need to be aware of this vulnerability and take appropriate action to protect their systems.

Cybercriminals are posing as legitimate artificial intelligence applications to spread malware, specifically cryptocurrency miners, in a campaign known as Yoba. They create fake GitHub repositories that claim to offer desktop applications like GPT-5.6 Sol, GPT-6 Astra, and Claude Opus. Users who download these applications unknowingly install malicious software designed to hijack their computer's resources for crypto mining. This tactic not only affects individual users but also raises concerns about the security of software development platforms like GitHub. As these fake applications circulate, users need to be cautious and verify the authenticity of software before downloading it.

The article discusses how AI agents are being used in web browsers to perform tasks that mimic human behavior, potentially putting sensitive data at risk. These agents can interact with corporate applications and access authenticated sessions, which makes it hard for traditional security tools to differentiate between AI activity and genuine user actions. This situation raises concerns for companies that rely on standard security measures, as they may overlook these automated threats. As AI technology continues to evolve, organizations need to be aware of these risks and adapt their security strategies accordingly to protect sensitive information. The implications of undetected AI agents could lead to significant data breaches or unauthorized access to critical systems.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning to federal agencies regarding a serious vulnerability in the Linux kernel that allows attackers to escalate privileges. This flaw is being exploited in conjunction with existing vulnerabilities in PHP2Shell, which is a known web shell tool. The combination of these issues presents a significant risk to systems running affected versions of Linux, as attackers can gain unauthorized access and control. Agencies are urged to take immediate action to protect their systems, especially given the potential for these vulnerabilities to be actively exploited in the wild.

Adobe, Veeam, and Juniper Networks have released patches for several serious vulnerabilities that could allow attackers to execute arbitrary code, bypass authorization, or escalate privileges. These flaws affect a range of products, putting users at risk of unauthorized access and control over their systems. It’s crucial for organizations using these products to apply the updates as soon as possible to protect against potential exploitation. The vulnerabilities were identified by security researchers, emphasizing the ongoing need for vigilance in maintaining software security. Users should check for the latest versions and apply the patches to mitigate these risks effectively.

A researcher discovered that over 26,400 valid credentials were publicly accessible in Gitee repositories, a popular Chinese code-hosting platform. The credentials included keys for various cloud and AI services, which were still functional when tested. This incident was reported by independent researcher Ben Zimmermann on October 28, after he scanned around 7.25 million public repositories. The exposure of these credentials poses a significant risk, as anyone could have easily copied and misused them. Developers and organizations using Gitee need to be vigilant about safeguarding sensitive information in their code.

Cisco has issued patches for a serious vulnerability in its Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software. The flaw, identified as CVE-2026-76418, has a CVSS score of 8.6, indicating a high severity level. Attackers can exploit this vulnerability remotely without authentication, potentially leading to a crash of the affected firewalls. This situation is particularly concerning as it has already been exploited in the wild, putting users at risk of service disruptions. Organizations using these Cisco products are urged to apply the patches promptly to mitigate the risk of exploitation.