Latest Cybersecurity Articles — AI-Scored and Summarized

Hackers are actively exploiting CVE-2026-106931, an OS command injection flaw in SiteGuard Server Edition WAF, enabling root/SYSTEM command execution on up to 1.5 million affected websites.

• CVE-2026-106931: OS command injection in SiteGuard Server Edition statistics function (enabled by default), allowing arbitrary command execution as root/SYSTEM; EPSS 0.66%, CVSS not yet assigned by…
• Affected versions: Apache/Nginx/IIS (non-FreeBSD) v2.20–before 8.00 Update 5; FreeBSD v2.20–before 7.00 Update 6; IIS 3.10–4.00 Update 4 not affected
• Vendor provides file-replacement patch including for EOL versions; administrators must download 'Diagnostic information' from web management interface before patching to preserve attack traces

ConnectWise disabled seven application identities and suspended Cloud Backup after attackers compromised Microsoft 365 tenants via stolen OAuth credentials, with ~300 confirmed Entra tenant sign-ins and a second targeted wave against national security and policy sectors.

• Attackers abused stolen ConnectWise OAuth application credentials to authenticate as the app to Microsoft Entra ID, request access tokens, escalate to Global Administrator, and add client secrets for…
• IOC: IP 144.172.64[.]128 linked to malicious sign-ins; ~1,000 Entra tenants showed sign-in activity, 300 succeeded; second wave targeted 16 tenants across SkyKick, Exchange Online, SharePoint, Teams,…
• Seven ConnectWise application identities disabled (including Cloud Backup, Cloud Management, MS Teams, Exchange Online, MS Graph, Partner Center, SharePoint Online); previously issued access tokens…

Drupal patches two critical unauthenticated RCE vulnerabilities in core Field UI and Entity List modules, warning exploits could emerge within hours or days.

• CVE-2026-108097: RCE in Drupal core Field UI module — requires contributed modules or custom code to exploit, but at least one unauthenticated path exists; CVE-2026-108099: RCE in contributed Entity…
• Patch targets: Drupal core 10.6.19, 11.3.19, or 11.4.10 (branch-dependent); Entity List module update to 3.0.10.
• Mitigation for systems unable to patch immediately: uninstall the core Field UI module (field_ui); Drupal Steward covers only some known attack vectors.

The MALFEX campaign's latest npm package 'imgdecode' hides a Windows DLL shellcode loader that injects into dllhost.exe, delivering a RAT/stealer targeting developer credentials and crypto wallets.

• imgdecode 1.0.3 embeds a 64-bit MSVC DLL that fetches encrypted shellcode from GitHub (cavecrew/proj), decrypts with key 'nif-runtime-2027', and injects into dllhost.exe; C2 at 104.234.65.75:700 and…
• Malware (movinlike/Koske) harvests .kdbx, .pem, .ppk, .env files, Chromium browsers, Discord, Telegram, crypto wallets, and gaming platforms; establishes WebSocket C2 for shell/file/screenshot/input…
• Persistence via Registry Run key and scheduled task 'MicrosoftEdgeUpdateService'; anti-analysis checks for VMs, sandboxes, Process Monitor, and Wireshark; SHA256…

Citizen Lab exposes Israeli ad firm Discover-Tech as a front for Candiru spyware delivery via zero-click RTB advertising attacks, targeting Al Jazeera and millions of devices globally.

• Discover-Tech's Controlium platform delivers zero-click spyware via RTB ad auctions: ads auto-connect to Discover-Tech infrastructure, submit advertising IDs, and execute JavaScript payloads based on…
• 14 verified IOCs (domains) associated with the campaign including adsmetrics.co, statsads.co, statsupplier.com, redirstats.com, and infoquiz.net (OTX, 70% confidence); a Discover-Tech server exposed…
• Threat actor Dark Cartographer linked to the ecosystem is building databases correlating mobile advertising IDs to phone numbers by exploiting mobile carrier vulnerabilities, enabling mass…