Threat Library

Russian FSB Center 16 (aka Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard, Static Tundra) is conducting a long-running, opportunistic global campaign exploiting poorly configured and vulnerable networking devices, primarily routers, using SNMP abuse and known Cisco CVEs. Targeting spans critical infrastructure sectors including communications, energy, financial services, defense industrial base, government, and healthcare. A joint advisory from CISA, NSA, FBI, and 15 international partner agencies urges organizations to harden router/SNMP configurations and disable legacy protocols.

CISA added CVE-2008-4128, a Cross-Site Request Forgery vulnerability in Cisco IOS, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. Federal Civilian Executive Branch agencies must remediate this per BOD 26-04, and CISA recommends all organizations prioritize patching this vulnerability on publicly exposed assets.

A critical unauthenticated OS command injection vulnerability exists in Vitec Flamingo 4.12.2's graph generation endpoint, allowing remote attackers to execute arbitrary commands with root privileges. The flaw stems from unsanitized GET parameters being passed directly into shell execution functions, combined with insecure passwordless sudo configuration on the web server. Given the CVSS score of 9.8 and lack of authentication requirement, this is highly likely to be mass-exploited by opportunistic attackers and botnets once a public PoC emerges.

A vulnerability in gawk's builtin.c (do_sub() routine) allows an integer overflow that corrupts heap metadata and objects, causing crashes on 32-bit builds of gawk version 5.4.0 and earlier. The flaw could potentially be leveraged for further exploitation beyond denial of service depending on heap layout and attacker control over input strings passed to gawk substitution functions.

A critical integer overflow vulnerability in gawk's builtin.c allows attackers to trigger memory exhaustion and corrupt heap metadata with attacker-controlled bytes, affecting versions 5.4.0 and below. Given gawk's ubiquity as a core text-processing utility on Linux/Unix systems, this vulnerability poses risk to any system, script, or automated pipeline that invokes gawk for data transformation.

A critical unauthenticated OS command injection vulnerability affects the Comfast CF-WR631AX V3 router firmware up to version 2.7.0.8, exploitable remotely via the system_wl_upload_pic_file function in the webmgnt FastCGI backend. A public exploit exists, and the vendor has not responded to disclosure, leaving affected devices permanently exposed to compromise.

ImageMagick versions prior to 7.1.2-19 contain a heap buffer over-read in the magnify operation, triggered by an unrecognized magnify:method value. Exploitation can lead to information disclosure from adjacent heap memory or crash the process, resulting in denial of service.

Cisco IOS 12.4 contains cross-site request forgery vulnerabilities in its HTTP-based management interface, allowing remote attackers to trick authenticated administrators into executing arbitrary privileged commands. This flaw is included in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Successful exploitation could lead to full device reconfiguration or compromise of network infrastructure.

This is a Simon Willison blog post sharing a GitHub code-frequency chart to illustrate how much AI coding agents (e.g. Opus 4.8, GPT-5.5) have increased his output on the Datasette open source project. There is no security vulnerability, attack technique, or agent threat described in this content.

MCP Appium, an MCP server for automating mobile app testing, fails to sanitize attacker-controlled UI element attributes before embedding them in an HTML template returned by its generate_locators tool. A malicious mobile app under test can inject HTML/JavaScript that executes in the MCP client's rendering context and calls arbitrary MCP tools via postMessage, effectively letting the app-under-test hijack the testing agent's capabilities.

The China-linked threat actor Silver Fox has been attributed a new Rust-based remote access trojan called MODBEACON, which uses gRPC streaming to encrypt and obfuscate its command-and-control traffic. Despite appearing as an opportunistic, low-sophistication campaign relying on SEO poisoning and trojanized installers for distribution, researchers assess the group demonstrates notable organizational and technical maturity.

Security researchers disclosed a chained exploit involving three now-patched vulnerabilities in the OpenClaw personal AI assistant that could be triggered via WhatsApp messages to achieve credential theft, privilege escalation, and arbitrary code execution on the host system. The attack chain leverages the assistant's integration with messaging platforms as an entry point, ultimately compromising the underlying host running the AI agent.

Ledger's Donjon security team demonstrated a physical fault-injection attack using a precisely timed laser pulse against the secure chip in Tangem crypto wallet cards, allowing an attacker to reset the card's password without knowledge of the original credential. Once reset, the attacker gains full control of the wallet and can transfer out any stored funds. The attack requires specialized equipment, physical possession of the card, and cannot be remediated via software patch since it exploits hardware-level fault injection.

A new variant of the RedHook Android malware exploits the Android Wireless Debugging (Wireless ADB) feature to obtain shell-level access on infected devices without requiring a wired connection to a computer. This removes a key barrier that previously limited ADB-based attacks, making device compromise more autonomous and scalable. The technique poses a significant risk to Android users and enterprises relying on mobile devices for authentication and access.

This article is a routine product availability notice stating Anthropic has extended free access to its Claude Fable 5 model for paid subscribers until July 19. It contains no indicators of a security vulnerability, breach, or malicious activity and does not constitute a cyber threat.

This item is a routine product/operations announcement from OpenAI regarding temporary relaxation of usage limits on GPT-5.6 Sol due to surging demand. It does not describe a vulnerability, exploit, or malicious activity and carries no direct security threat.

Flowise, a popular low-code AI agent/LLM workflow builder, ships with hardcoded fallback JWT secrets, audience, and issuer values that activate silently when operators fail to set the corresponding environment variables. An attacker who knows these public default values can forge valid JWTs to impersonate any user, including administrators, granting full control over the agent platform and any connected tools, credentials, or workflows.

Crawl4AI, a popular web-crawling library used to feed content into LLM pipelines and RAG systems, contains a critical arbitrary file write vulnerability in its Docker API server's /screenshot and /pdf endpoints. Unauthenticated or low-privilege attackers can supply crafted output_path values to write files anywhere the service account can access, potentially overwriting critical server files and causing denial of service or further compromise.

This is a short opinion/commentary post by Simon Willison discussing the organizational concept of 'Directly Responsible Individuals' (DRI) and arguing that AI agents should never hold this accountability role since accountability is inherently human. There is no technical vulnerability, exploit, or security incident described here; it is a governance and ethics discussion.

AstrBot's dashboard MCP connection test feature allows an attacker to supply an arbitrary URL that the server will fetch, resulting in server-side request forgery (SSRF). This could let an attacker probe internal networks, hit cloud metadata endpoints, or pivot against internal services from the AstrBot server. Exploit details are public and the vendor has not responded, increasing real-world risk.