September 03, 2026
September 03, 2026 Hash 165fece5410154d1cf78f0e5c2c425c11 2a0c9adcbe6147ce06709a847735bdd36 3731e357c72ba9f6b59f29f9b0e07ca06 URL 1http[:]//doutorurgencia[.]com/ 2http[:]//lipsell[.]nl/ 3http[:]//hindinewsportal[.]in/ IP 1193[.]32[.]162[.]84 280[.]94[.]92[.]234 327[.]78[.]38[.]156...
Ransom & Dark Web Issues Week 1, September 2026
ASEC Blog publishes Ransom & Dark Web Issues Week 1, September 2026 ZaWoo Data Extortion Attacks Against Multiple Organizations Worldwide Black X Ransomware Attack on a South Korean Automotive Parts Manufacturer Internal Data of a South Korean Asset Management and Investment Firm Offered for Sale
Attack Cases in Korea Involving the Installation of Radmin and UltraVNC
The AhnLab SEcurity intelligence Center (ASEC) recently identified attack cases that exploited Radmin and UltraVNC. Although the Initial Intrusion method remains unknown, the attackers installed Radmin—a remote control tool—and then installed UltraVNC. The threat actors exploited the remote control tools to gain control of the infected systems and installed Netch
Detection and Removal of the Syslogk Rootkit in a Linux Environment
1. Overview The AhnLab SEcurity intelligence Center (ASEC) continuously monitors various threats targeting Linux environments. Techniques that modify the Linux kernel to conceal malware and signs of compromise have been used for a long time, and Syslogk is one such rootkit that operates in this manner. This document provides an
Kestra Security Update Advisory (CVE-2026-49869)
A security update has been released to address a vulnerability in Kestra. Affected products include Kestra OSS versions prior to 1.0.45 And prior to 1.3.21. The vulnerability addressed is CVE-2026-49869, a remote code execution vulnerability caused by authentication bypass in AuthenticationFilter. A patch for this vulnerability is available in the
Gitea Security Update Advisory (CVE-2026-60004)
Overview A security update has been released to address a vulnerability in Gitea. This vulnerability is identified as CVE-2026-60004. Affected Products Affected products are Gitea versions 1.17 Through 1.27.1. Vulnerability Details A remote code execution vulnerability (CVE-2026-60004) occurs in Gitea’s diffpatch endpoint due to the installation and execution of Git
JFrog Product Security Update Advisory (CVE-2026-82329)
A security update has been released to address vulnerabilities in JFrog products. The affected product is JFrog Artifactory, and the Affected Versions are 7.111.4 Through 7.111.20, 7.117.0 Through 7.117.27, 7.125.0 Through 7.125.19, 7.133.0 Through 7.133.28, 7.146.0 Through 7.146.36, And 7.161.0 Through 7.161.19. The resolved vulnerability is CVE-2026-82329, which is a
LiteLLM Security Update Advisory (CVE-2026-59822)
Overview A security update has been released to address a vulnerability in LiteLLM. This vulnerability is an authentication bypass issue (CVE-2026-59822) caused by an error in the OAuth2 passthrough fallback handling. Affected Products LiteLLM versions prior to 1.84.0. Resolved Vulnerabilities CVE-2026-59822. This is an authentication bypass vulnerability caused by an
Security Update Advisory for SonicWall Products
SonicWall Product Security Update Advisory SonicWall has released a security update to address a vulnerability discovered in the SMA1000 product. Affected models include the SMA1000 6210, 7210, and 8200v. The vulnerabilities addressed as follows are as follows: CVE-2026-83548: A pre-authentication SSRF (Server-Side Request Forgery) vulnerability occurring in the SonicWall SMA1000
Sangoma Product Security Update Advisory
Overview A security update has been released to address a vulnerability in Sangoma products. The affected product is Sangoma Switchvox SMB, and users should update to the latest version. Affected Products Sangoma Switchvox SMB. Affected versions are 8.3 (104997) Through 8.4.0.2. Fixed versions are 8.4.0.2 And later. Identified Vulnerabilities CVE-2026-9585:
