Threat Library

Watchfire Controller Software used in digital billboard/LED sign controllers (BC550, BC750, BC760, BC760DC) contains hard-coded, self-signed RSA private keys and X.509 certificates embedded in plaintext firmware patch binaries. Successful exploitation could allow an attacker to intercept or spoof HTTPS/TLS connections to the web management interface and deliver malicious firmware to gain full control of the controller. Watchfire has released patched firmware versions to remediate the issue.

A critical shell injection vulnerability in Wazuh's GitHub Actions workflows allows attackers to execute arbitrary commands by submitting malicious pull requests containing crafted VERSION.json files. Because affected variables are directly interpolated into shell run steps, attackers can achieve command execution and exfiltrate sensitive secrets such as GITHUB_TOKEN and AWS credentials, particularly dangerous on self-hosted runners with broader network and credential access.

FreeRDP versions up to 3.28.0 fail to sanitize CRLF and control characters in the server-controlled TargetNetAddress field of RDP redirection PDUs. A malicious or compromised RDP server can exploit this to inject arbitrary headers or requests into the client's HTTP proxy CONNECT request, potentially enabling request smuggling, proxy authentication bypass, or lateral request injection against internal infrastructure.

FreeRDP versions up to 3.28.0 contain multiple flaws in their custom TLS certificate identity verification logic, allowing an attacker with a trusted or misissued certificate to impersonate legitimate RDP servers. This weakens TLS server authentication and enables man-in-the-middle attacks against RDP sessions, with a critical CVSS score of 9.8.

The Single Sign On For TNG WordPress plugin (versions up to 2.0.0) contains a critical authentication bypass vulnerability allowing unauthenticated attackers to reset any account's password, including administrators. Exploitation leads to complete site takeover with no user interaction or prior authentication required.

The FormGent WordPress plugin (versions up to 1.9.2) contains a critical unauthenticated arbitrary file deletion vulnerability caused by a missing capability check on its REST API endpoint. On Linux servers, attackers can bypass path traversal protections to delete wp-config.php, forcing the site into a fresh-install state that enables full site takeover.

This is a release note describing a legitimate new feature in datasette-apps that lets an AI agent open an app in a hidden, non-interactive iframe and run agent-provided JavaScript to smoke-test it. There is no evidence in this data of a vulnerability, exploit, or malicious use; it is a feature announcement rather than a threat report. Severity is rated low because no genuine security issue is described.

better-auth's OIDC provider and MCP plugin fail to validate the URI scheme of registered OAuth redirect_uris, allowing an attacker to register a javascript: URI that gets echoed back to the consent page. If the consent UI navigates to this URI unsafely, attacker JavaScript executes in the authorization server's origin, potentially hijacking victim sessions. This is a classic web input-validation flaw made newly relevant because it affects the auth layer underlying MCP server deployments, extending its blast radius to agent tool-authorization flows.

The new datasette-agent release adds a browser_task mechanism that lets agent tools run arbitrary JavaScript directly in the user's browser. This significantly expands the agent's capability surface into the client-side execution context, meaning a compromised or malicious tool/plugin, or a prompt-injected agent, could execute code with the user's browser session privileges (cookies, DOM, same-origin requests). This is not confirmed to be exploited, but the architecture introduces a new high-value attack surface that warrants scrutiny.

This entry is simply a blog/release announcement for llm-mcp-client 0.1a0, a client tool for interacting with MCP (Model Context Protocol) servers, written by Simon Willison. The raw data contains no description of an exploit, vulnerability, or attack technique; it is a changelog/release note pointing to a GitHub release and a blog post.

Researchers at Bitsight identified an operation dubbed Fuyao in which cheap Android TV boxes ship with pre-installed apps that spoof device identifiers to impersonate Samsung, Huawei, Xiaomi, or Vivo smartphones, enabling large-scale ad fraud. The same devices are also weaponized to covertly route third-party traffic through owners' home broadband connections, effectively turning them into residential proxy nodes. The operation has been attributed to Zhejiang Fengwo IoT Technology Co., Ltd., a China-based manufacturer.

A newly documented Go-based loader called HollowFrame is being used to deploy a Rust-based backdoor tracked as Matryoshka in targeted spear-phishing attacks, with at least one confirmed intrusion against a law firm. The infection begins with a phishing email linking to an encrypted archive containing a malicious Windows LNK file that triggers a multi-stage execution chain leading to backdoor deployment.

A suspected Chinese-speaking threat actor has been conducting an espionage campaign since January 2025, primarily targeting government organizations in Central Asia and Afghanistan, as well as Syria. The campaign employs two custom malware families, OctLurk and SilkLurk, to establish persistent access for likely intelligence collection purposes.

Attackers compromised Adform's ad-serving script, injecting malicious JavaScript into websites using the platform. The script performs clipboard hijacking, replacing copied cryptocurrency wallet addresses with attacker-controlled addresses to redirect funds. This is a classic supply-chain attack leveraging a trusted third-party ad network to achieve broad, indirect distribution across many unrelated sites.

A wave of malicious actors have been adopting abandoned or orphaned Arch User Repository (AUR) packages and inserting malware into them, prompting Arch Linux to temporarily disable the package adoption feature. This supply-chain attack vector allows attackers to compromise trusted package names that users and automated systems may install without deep scrutiny.

Amgen disclosed a data breach in which threat actors stole corporate and patient health data stored across multiple cloud systems operated by third-party service providers. The incident highlights ongoing risks tied to outsourced cloud infrastructure and vendor security posture in the pharmaceutical sector.

Toptech Systems RCU II+ and Multiload II+ devices, used in fuel management systems within the energy sector, expose an unauthenticated Target Communications Framework (TCF) debug service that grants full root-level access to the underlying embedded Linux system. An attacker with adjacent network access could exploit this to view/modify the filesystem, manipulate processes, and control network interfaces, effectively achieving full device compromise. CISA rates this CVSS v3.1 8.8 (High), though exploitation requires network adjacency rather than remote internet access.

A session-management flaw in MikroTik RouterOS's API allows authenticated users whose permissions have been downgraded to retain their prior access levels, since sessions are not properly invalidated after permission changes or inactivity timeouts. The advisory description also notes a more severe potential consequence: low-privilege API access could be leveraged to extract a router's WireGuard private key in plaintext, enabling full VPN impersonation and decryption of associated traffic. No public exploitation has been reported at this time.

CISA has released guidance titled 'Open Source Software: Security Principles and Practices' to help agencies and organizations securely use, evaluate, and publish open source software. This is not a threat disclosure but a best-practices document covering OSS lifecycle risk management, a new C4 Framework for trust assessment, SBOM usage, secure development, and handling open source AI systems.

CVE-2026-68771 is a critical unauthenticated remote code execution vulnerability in ComfyUI v0.23.0, a widely used node-based interface for AI/ML pipelines including Stable Diffusion and generative workflows. Attackers can upload a malicious pickle file and trigger deserialization via the LoadTrainingDataset node, achieving arbitrary code execution as the ComfyUI process user with no authentication required.