September 28, 2026
September 28, 2026 Hash 1b5b679c6ab4512360b0119da9b52654b 21ac6673dc2738021d1f2059674934cfe 39027907d9bc0013feb0e3a3349658139 URL 1http[:]//vnalra[.]hornygiirls[.]com/ 2http[:]//online-mediation-beratung[.]de/ 3http[:]//trronline[.]se/ IP 1154[.]18[.]197[.]35 24[.]224[.]40[.]94 331[.]56[.]19[.]21...
Vulnerability Attack Case: Installation of a Web Shell and Execution of a Scanner by Exploiting a Telerik UI Vulnerability
The AhnLab SEcurity intelligence Center (ASEC) has identified two vulnerability attack cases that exploited a remote code execution vulnerability (CVE-2019-18935) targeting unpatched Telerik UI for ASP.NET AJAX servers. In the first incident, after exploiting the vulnerability, the attacker executed a reverse shell, attempted to perform privilege escalation, and installed a
Adobe Product Security Update Advisory (CVE-2026-71362)
Overview Security updates have been released to address vulnerabilities found in Adobe products. These updates apply to Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. Resolved Vulnerabilities CVE-2026-71362: An incorrect authorization vulnerability in Adobe Commerce and Magento Open Source. This vulnerability could allow an attacker to gain access to
WSO2 Product Security Update Advisory (CVE-2026-5430)
WSO2 Product Security Update Advisory (CVE-2026-5430) A vulnerability (CVE-2026-5430) in the JWT authentication process of WSO2 products has been discovered, and a security update has been released. This vulnerability allows authentication bypass through tokens signed with unsupported algorithms. Affected Products WSO2 API Control Plane 4.5.0. WSO2 API Control Plane 4.6.0.
WordPress Security Update Advisory (CVE-2026-87902)
WordPress Security Update Advisory. CVE-2026-87902, a vulnerability in WordPress that allows PHP files to be included through page template path traversal, has been resolved. Follow the instructions on the reference site to update to the latest version with the Vulnerability Patch. Affected Versions include various WordPress versions ranging from 4.7.0
F5 Product Security Update Advisory (CVE-2026-94127)
Overview F5 has released a security update that addresses vulnerability CVE-2026-94127 in BIG-IP APM. This vulnerability is a pre-authentication remote code execution vulnerability caused by a heap-based buffer overflow (memory handling error) in the OAuth authentication server feature of BIG-IP APM. Affected Versions The following BIG-IP APM versions are affected:
Beware of Phishing Emails That Disguise Themselves as Project Material Purchase Requests
Recently, the AhnLab SEcurity intelligence Center (ASEC) identified a case of phishing emails that disguise themselves as project material purchase request forms. These emails impersonate employees of a specific company in Korea and trick recipients into opening a malicious XLS file attached to the email, which is disguised as a
Beware of phishing emails disguised as quote requests
Recently, the AhnLab SEcurity intelligence Center (ASEC) confirmed that phishing emails disguised as requests for project quotes are being circulated. The email body is disguised as a request to submit a quote for discussing the project budget and prompts recipients to download an attached compressed file for verification. [Figure
SilverFox: Tracking the Distribution of a Domestic Variant of a Malicious Installation File Posing as KakaoTalk
The threat actor used SEO poisoning (a technique that exploits search results to redirect users to fake sites) to distribute a malicious installer disguised as a KakaoTalk installer. The appearance and packaging method of the installer changed continuously, and the threat actor sequentially used NSIS, Advanced Installer, and Inno Setup.
